The DeadLock ransomware group has listed Fidex, a Mexican insurance broker and risk management firm, as a new victim, according to threat intelligence reporting published on 8 November 2026. The listing was first flagged by ThreatMon and recorded by the Ransomware.live tracker at 19:51 UTC on 8 November.

Fidex Seguros y Fianzas, established in 2002, provides corporate and personal insurance solutions, bond underwriting and employee benefits advice in Mexico. Its website is fidex.com.mx. The group’s listing names the company as a claimed victim, but no technical details about the alleged intrusion have been made public.

What is known so far

According to the reports, DeadLock added Fidex to its victim list on 8 November. No information has been released about how the firm was allegedly breached, which systems were affected, whether data was stolen, or whether a ransom was demanded. Fidex has not, in the material reviewed, issued a public statement confirming an incident.

That means the case should be treated as an unverified threat-actor claim rather than a confirmed data breach. A ransomware group’s victim-list publication is not, on its own, proof that a network was compromised, that files were encrypted, or that data was taken.

Second victim named the same day

ThreatMon reported that DeadLock listed a second organisation on the same day: Trinity Custom Homes, a manufacturing-sector company in the United States. As with Fidex, the available reports provide no evidence of data theft, encryption or operational disruption at the company.

DeadLock is described by threat intelligence researchers as a double-extortion operation, meaning it typically steals data before encrypting files, so victims face pressure to pay both to restore access and to stop stolen data being published. The group has been credited with 117 victims in one threat intelligence database. Whether either of the 8 November listings follows that pattern is not yet known.

Why insurers are watched closely

Insurance brokers hold sensitive client, policy and financial records, which makes them attractive targets for extortion groups. A confirmed breach at a broker could expose policyholder details and business information, but no such exposure has been established in this case.

Security teams are advised to watch for further disclosures from the group, such as data samples, and for any statement from Fidex itself. Until independently verified evidence appears, the incident remains a claim to monitor, not a confirmed breach.

Organisations in the insurance and financial services sectors can use the report as a prompt to check their own defences, including multi-factor authentication, offline backups and monitoring of dark-web leak sites, which are often the first public sign that a ransomware group has named a new victim.