Abans Group Data Breach

Abans Group, a consumer services company based in Sri Lanka, was listed as a victim on the BlackNevas ransomware group’s dark web portal on July 1, 2026. SOCRadar identified this listing through its Dark Web Monitoring service. This incident is notable as it involves a South Asian consumer business, which is a less common target for this particular threat actor.

SOCRadar’s analysis revealed a severe exposure for the abansgroup.com domain through its stealer-log telemetry. The compromised logs contained corporate credentials for identity, mail, and SaaS platforms, along with employee accounts on third-party services. This suggests a direct risk of unauthorized access to corporate systems and potential compromise of employee devices. The exposure of credentials for core identity and mail infrastructure, rather than just consumer-facing portals, elevates this finding to a severe level, indicating a potential for unrotated access to critical authentication systems. The typical kill chain for ransomware groups like BlackNevas involves sourcing these credentials from underground marketplaces to gain access to corporate networks before deploying ransomware. CTI teams are advised to prioritize credential rotation for identity and mail platforms and audit recent authentication events.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.