Asl matn EN tilida, manba saytidan olindi. Manba ↗

Hackers are using exposed credentials to access limited corporate data, then presenting that access as evidence of major breaches to pressure companies into paying.

The findings concern external attacker activity affecting third parties, not a compromise of ReliaQuest’s environment.

They highlight a distinction: authentic leaked records do not automatically prove the extensive network intrusion an extortion group claims.

First observed in July 2026, ExfilSquad published JSON samples containing employee names, aliases, identifiers, email addresses, telephone numbers, and workplace locations.

The samples also included empty fields and general customer relationship management information. ReliaQuest assessed that the material did not establish a broader network breach or tenant compromise.

Researchers believe the actor very likely searches GitHub for exposed credentials, then retrieves whatever information those accounts permit it to access.

That assessment remains a likely explanation, not a confirmed reconstruction of every claimed incident.

ExfilSquad’s website claims it publishes companies that “fail to meet an agreement,” portraying disclosures as consequences of unpaid demands.

However, researchers observed missed publication deadlines and listings without supporting samples. Neither proves that no compromise occurred, but both weaken the site’s presentation of verified breaches.

The likely consequences include targeted phishing against exposed employees and the operational cost of investigating allegations.

ExfilSquad data leak site informational page, claiming to publish companies that fail to meet an agreement (Source : ReliaQuest).

ReliaQuest’s Threat Research team identified, ExfilSquad as a likely example, warning that ransomware-style leak sites can exaggerate compromises without substantiating the scale of intrusion they imply.

Organizations must therefore distinguish genuine credential abuse from unsupported claims of extensive data theft.

The activity accompanies a broader distortion in ransomware reporting. Organizations named on leak sites increased 30% during Q3 2026, but 43 newly observed groups accounted for 93% of that growth.

Manufacturing victims named on data-leak sites grew by 70% in Q3, cutting PSTS lead from 420 victims to 106.

Total number of organizations listed on data leak sites by sector, Q3 2026 (Source : ReliaQuest).

Listings from groups active in both Q2 and Q3 increased just 1%.

ReliaQuest cautioned that new listings may combine fresh intrusions, rebrands, recycled information, and false allegations.

Global Secret Group published 28 of its 48 listed victims on one day, while crpx0 posted 41 of 47 simultaneously. Such batches suggest precollected material, although they do not establish fabrication.

The US share of all listed victims fell for the second consecutive quarter: from 55% in Q1, to 49% in Q2, to 41% in Q3.

US share of data leak site victims, Q1 vs. Q2 vs. Q3 2026 (Source : ReliaQuest).

Consequently, counting leak-site entries cannot reliably measure successful ransomware attacks. Tracking established group names alone would also have missed almost all the quarter’s increase.

Defenders should compare published samples with internal records, authentication telemetry, application access logs, and export activity.

Investigators must establish whether unauthorized access occurred, what information was reachable, and whether the evidence supports the attacker’s account before determining containment priorities.

Repository exposure deserves particular attention. GitHub’s secret-scanning documentation explains that scanning covers repository history across branches and detects credentials such as passwords, tokens, and API keys.

Exposed credentials should be rotated immediately; removing them from source code alone does not invalidate them.

ReliaQuest also recommends reviewing CRM and portal logs for unusual bulk reads, revoking exposed secrets, and monitoring leak-site references to organizations and vendors.

These measures address the suspected access route without accepting an extortionist’s narrative as fact.

The broader StopRansomware Guide provides related preparation, prevention, and mitigation guidance for ransomware and data extortion.

For security teams, the priority is evidence-led response: investigate the allegation, contain verified exposure, and avoid equating a threatening listing with a proven enterprise-wide breach.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.