Aquamar Inc Data Breach

Aquamar Inc, a United States-based company operating in the seafood processing and distribution sector of agriculture and food production, was identified as a victim on the MetaEncryptor ransomware group’s leak site on August 23, 2026. This listing places Aquamar Inc among MetaEncryptor’s victims, with the Agriculture and Food Production industry being one of the group’s top three most frequently targeted sectors. The company’s US location aligns with other recent MetaEncryptor targets, suggesting a potential pattern in the group’s operational focus. In the preceding 60 days, MetaEncryptor claimed approximately seven victims, primarily targeting sectors including “Other,” Manufacturing, and Agriculture and Food Production. The group’s most affected countries include the United States, Japan, and Germany. Aquamar Inc’s classification within the food production sector aligns with MetaEncryptor’s documented targeting preferences, indicating that Aquamar Inc may have been a deliberate choice rather than a random target. This aligns with other US-based victims like FactoryFive, Weber Water Resources, and Trailer Transit Inc.

An analysis of SOCRadar’s stealer-log telemetry for the domain aquamarseafood.com did not yield any records within the queried sample. However, it is crucial to note that a null result does not confirm the organization is unaffected. The telemetry data queried was paginated, meaning it may not represent the entirety of available records. Furthermore, credentials associated with alternate corporate domains or personal email aliases used by employees fall outside the scope of this specific query. It is also possible that any compromised credentials may have been used and subsequently rotated by the threat actor before being indexed in the available datasets. Infostealer-harvested credentials are a well-established initial access vector for ransomware operations, allowing threat actors to gain access to corporate networks. While no direct evidence of such credentials for Aquamar Inc was found in this particular stealer-log analysis, the absence of a finding within a limited sample does not rule out the possibility of compromised credentials existing elsewhere or having been used and rotated. Threat actors like MetaEncryptor have been known to utilize various initial access methods, including phishing campaigns, exploiting exposed VPN appliances, and leveraging recycled or previously compromised credentials. Therefore, organizations should not solely rely on the absence of telemetry findings for a complete security posture assessment. Given the listing on a ransomware leak site, it is strongly recommended that Aquamar Inc undertake comprehensive security measures. This includes continuing dark web monitoring for any further mentions or leaked data, conducting proactive credential hygiene checks, rotating all passwords, reviewing and enforcing multi-factor authentication on all internet-facing services, and closely monitoring authentication logs for suspicious activity across their Microsoft 365 environment, VPNs, and other remote access portals. These actions are crucial for mitigating potential risks and responding to the intelligence provided by the leak site listing.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.