XP95 is a cyber-extortion group that emerged in March 2026, distinguishing itself by exclusively employing a data-theft-and-extortion model rather than deploying encryption malware. The group operates a data leak site characterized by a Windows XP/95 theme, where it publishes proof-of-compromise samples, often cross-posting to platforms like BreachForums. Its primary motivation is financial gain through extortion. Notable early targets include Statistics South Africa, where it exfiltrated 154 GB of data, the Gauteng Provincial Government, and Eholo Health, a Spanish mental health SaaS platform serving over 10,000 psychologists across Spain and Andorra. No indications suggest the group operates under multiple names or is commonly confused with other unrelated threat actors, though its name is a clear stylistic reference.

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker