Adpo Data Breach

Qilin ransomware listed Adpo, a transportation and logistics company based in Belgium, as a victim on July 30, 2026. This listing was identified through SOCRadar’s Dark Web Monitoring. The operational criticality for Adpo lies in maintaining transport uptime, making it a potential target for ransomware attacks. Adpo is among several European entities recently targeted by Qilin, fitting into the group’s pattern of impacting companies within the region. Based on SOCRadar’s analysis, Qilin has claimed 122 victims in the preceding 60 days, positioning them as one of the most active ransomware groups. Their typical targets are predominantly in Business Services, Manufacturing, and Technology sectors, with the United States, France, and Germany being their leading victim countries. Adpo’s inclusion aligns with Qilin’s targeting of European companies, although the transport sector is less frequently hit compared to the group’s core focus on business services and manufacturing. Nearby European victims, such as Orimar, Sintax, Indian Motos Inmot, and servitelco, further illustrate this regional pattern.

SOCRadar’s Dark Web Monitoring detected one record associated with the domain adpo[.]com, specifically linked to a corporate email address using the @adpo[.]com domain. This credential appeared to have been captured from an employee’s infected workstation during regular browsing activities, rather than indicating a direct compromise of Adpo’s core infrastructure. The available data did not include any credentials for identity providers, mail systems, or administrative endpoints, focusing instead on workstation compromise. The most recent activity associated with this record was in late February 2026. It is important to note that the presence of a single credential in the observed dataset does not preclude the existence of other compromised accounts or data outside of the sampled information. Qilin ransomware predominantly utilizes infostealer logs for initial access. Threat actors often source these logs through initial access brokers, who then validate corporate credentials. These validated credentials can grant access to systems such as Microsoft 365, VPNs, or remote access portals, from which the ransomware is subsequently deployed. While the detected credential for Adpo does not definitively confirm this specific intrusion vector, a compromised corporate account harvested from an infected endpoint represents precisely the type of foothold that ransomware operations of this nature frequently exploit. This discovery underscores the potential risk and highlights the importance of comprehensive monitoring for credential exposure and related attack vectors. Given the potential for credential compromise, recommended actions include rotating the affected account’s credentials, imaging the associated workstation for forensic analysis, and expanding the stealer-log query to include related corporate services and domains. This proactive approach can help mitigate further risks and enhance the organization’s security posture against similar threats.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.