The DeadLock ransomware group has listed Coopebis, an organisation in Costa Rica, as a claimed victim on its leak site, according to threat-intelligence reports published on 8 November 2026. The listing is, for now, an allegation by the attackers themselves. No independent evidence has been published to confirm that Coopebis was breached, that data was stolen, or that any systems were encrypted.

The claim was first flagged by the ThreatMon threat-intelligence team and reported on 8 November. Threat-intelligence records list Coopebis as based in Costa Rica and operating in agriculture and food production. The same records describe DeadLock as a group with 117 victims listed in their database, and place Costa Rica 64th worldwide for ransomware disclosures, with 21 victims recorded. Those figures come from the threat-intelligence database itself, and they describe the group's recorded activity rather than any confirmed damage in this case.

DeadLock is described by threat-intelligence analysts as a group that typically follows a double-extortion model. In that model, attackers first copy data out of a victim's systems and then encrypt the files on those systems. The victim is then faced with two demands at once: pay to get access to their files back, and pay again to stop the stolen data from being published. The leak site where the victim's name appears is the lever for the second demand, because it is the place where the group threatens to release the data if it is not paid.

It is important to be clear about what has not been established here. The reports carry no details about how the attackers are supposed to have gained access, whether through phishing, an exploited vulnerability, compromised credentials, or any other route. They give no account of which systems were affected, how much data, if any, was taken, or what type of information it might contain. There is no confirmed report of operational disruption at Coopebis, and no statement from the organisation itself has been reported in the coverage of the listing.

That absence of detail is normal at this stage of a ransomware claim, and it is also the reason the incident should not be described as a confirmed breach. A name on a leak site shows that a ransomware group is claiming a victim. It does not, on its own, prove that an intrusion succeeded, that data was taken, or that the named organisation is even the group it appears to be. Threat-intelligence reports on this listing make that distinction explicitly, and they classify the incident as an unverified claim rather than a confirmed data breach.

The listing nevertheless fits a wider pattern that has run through 8 November, with several organisations appearing on ransomware leak sites on the same day. Ransomware groups often publish batches of new names together, and the groups behind them compete for attention and for pressure on their victims. For organisations watching these lists, a new name is a signal to check their own defences, not a verdict on the named organisation.

For any organisation, the practical defences against groups like DeadLock are well established. Regular offline backups that have been tested for restoration limit the damage if files are encrypted. Network segmentation makes it harder for an attacker who gets into one part of a system to move across the rest of it. Multi-factor authentication on all remote access closes off one of the most common ways in, and endpoint detection tools can catch the activity that precedes encryption. Staff training on phishing, and monitoring of threat-intelligence feeds for indicators linked to active groups, complete the picture.

What happens next with Coopebis will depend on whether further evidence appears. The group may publish samples of allegedly stolen files, as ransomware operators often do to increase pressure, or the claim may remain unverified if nothing more is released. An official statement from the organisation, or a forensic finding, would change the picture. Until then, the honest description of this story is a narrow one: DeadLock has claimed Coopebis as a victim in Costa Rica, and that claim, reported on 8 November 2026, remains unverified.