AmSpec Data Breach

AmSpec, a company operating in the energy and utilities sector within the United States, has been identified as a victim on the Qilin ransomware group’s dark web portal, with the listing published on August 6, 2026. This discovery was made through SOCRadar’s Dark Web Monitoring service. AmSpec’s business involves testing and inspection services crucial for the energy sector, positioning it within the supply chains of various downstream operators. The listing places AmSpec among six new entries by Qilin on that date, and it stands out as the largest in terms of apparent employee numbers. In the 60 days leading up to this incident’s listing, Qilin claimed 135 other victims. The group frequently targets the manufacturing, business services, and professional services sectors. Geographically, their primary targets are in the United States, France, and Germany. Recent victims of Qilin that share similarities with AmSpec, such as being U.S.-based organizations or within the energy sector, include Service Electric, Crystal Pharmatech, J&T Bank and Trust, and Jakle & Alexander. While the energy and utilities industry is not typically Qilin’s top focus, the group’s high operational volume means that service providers connected to critical infrastructure are regularly impacted.

SOCRadar’s analysis of AmSpec’s domain, amspecgroup.com, using its stealer-log telemetry revealed a significant exposure. The queried sample contained twenty-five records, all associated with corporate identities. Eighteen of these were identified as employee credentials on organization-owned systems, and seven were classified as corporate user credentials for external services. Key systems involved included the Microsoft 365 tenant’s identity provider and a hosted email and collaboration platform, affecting multiple employees. The data is particularly concerning due to its recency, with the observed timeframe ranging from August 2, 2026, to August 6, 2026. This indicates that the harvested credentials were obtained within the four days immediately preceding the leak-site listing, with a notable cluster of accounts appearing on a private messaging channel during the same period. This profile strongly suggests a high corporate intrusion risk. For ransomware groups like Qilin, credentials harvested by infostealers are a well-established method for gaining initial access. Threat actors or initial access brokers acquire fresh logs from underground marketplaces, validate the corporate credentials, and then use them to access platforms such as Microsoft 365, VPNs, or remote-access portals before deploying ransomware. While the stealer-log data obtained does not definitively confirm that these specific credentials were used by Qilin, the appearance of corporate identity provider credentials just days before a leak-site listing represents the closest temporal correlation observed in this dataset. CTI teams should consider all identities within that timeframe as potentially compromised and should prioritize immediate credential rotation and session invalidation over waiting for direct causal confirmation. Continuous monitoring of dark web and stealer-log feeds for AmSpec-related data, proactive checks for credential hygiene, regular password rotation, and thorough review of multi-factor authentication settings, as well as monitoring of Microsoft 365, VPN, and remote-access activities, are strongly recommended.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.