daralteb.com Data Breach

daralteb.com, a medical information portal that serves Arabic-speaking patients in the Middle East, was listed on krybit’s dark web leak site on October 2, 2026. Krybit claims to have infiltrated the organization’s systems, exfiltrated proprietary data, and deployed ransomware. Healthcare portals that manage patient authentication and access to medical records are considered high-value targets due to the lucrative nature of patient data on criminal markets, the limited tolerance for downtime in healthcare, and the added regulatory pressures in MENA markets. This incident aligns with krybit’s established pattern of targeting organizations in the healthcare and digital services sectors that hold significant leverage. The incident is particularly concerning due to the extended period of credential exposure preceding the ransomware listing. SOCRadar’s stealer-log intelligence detected credential records associated with daralteb.com’s infrastructure dating from December 2024 up to September 12, 2026, indicating nearly two years of accumulated exposure. This prolonged exposure across the organization’s webmail system, test environment, and main domain authentication portals, with one key employee’s credentials appearing in 14 separate stealer-log entries, suggests a persistent infostealer presence rather than a one-off phishing attack. Such extensive credential exposure is typically aggregated by credential brokers and sold to ransomware operators, who then monetize this access.

SOCRadar’s CTI analysis identified a significant period of credential exposure related to daralteb.com, with stealer-log intelligence revealing relevant records from December 2024 through September 12, 2026. This extensive exposure predates the ransomware listing by nearly two years, indicating a substantial dwell time for potential attackers. The compromised credentials were found across the organization’s webmail system, a test environment, and main domain authentication portals, suggesting broad access to sensitive infrastructure. The persistence of these exposed credentials, with one identity appearing in 14 distinct entries, points to a continuous infostealer presence. The long gap between the initial credential exposure and the ransomware group’s listing of the victim is a critical finding. This 22-month window allowed attackers ample time to evaluate the compromised access, confirm its viability, and potentially sell it to other threat actors. This situation highlights the risks faced by organizations that do not actively monitor for their own credentials on stealer feeds, as it leaves them unaware of how long their stolen credentials might be evaluated and exploited. The data suggests that access brokers routinely aggregate such long-term exposures before selling them to ransomware operators. The prolonged exposure period underscores the need for immediate defensive actions. Organizations should prioritize forcing credential resets across all affected accounts, implementing multi-factor authentication on all externally accessible systems, and establishing continuous monitoring of the dark web for credential leaks. The nearly two-year window of opportunity that went unused by attackers in this case serves as a stark reminder of the potential consequences of insufficient security hygiene and monitoring.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.