D-MAX Engineering Data Breach

D-MAX Engineering, Inc., a United States-based firm operating in the manufacturing sector, has been listed as a victim of the spacebears ransomware group. The listing occurred on September 5, 2026, as observed by SOCRadar. D-MAX Engineering holds valuable proprietary design files and client specifications, which are particularly attractive to threat actors for extortion purposes. This intellectual property can be leveraged independently of ransom payments, increasing the leverage for threat actors and the potential damage to the victim. The spacebears ransomware group has been active, claiming 14 victims in the past 60 days. Their primary targets include the Technology, Retail & E-Commerce, and Healthcare sectors, with a focus on the United States, Italy, and the Czech Republic. Recent victims include Sports Endeavors, Schwartz Giannini Lantsberger & Adamson (SGLA), StellarRAD Systems, and Studio Oculistico Ciraci. D-MAX Engineering’s targeting aligns with spacebears’ ongoing pattern of compromising US industrial and manufacturing companies.

A stealer-log query was performed for the domain dmaxinc[.]com, but no records were returned. It is crucial to understand that a null result does not constitute a clearance, as credentials may exist in out-of-sample feeds or be associated with personal email aliases rather than the corporate domain queried. This absence of immediate findings warrants continued monitoring. Given the nature of ransomware operations, the potential for compromised credentials remains a significant concern. Infostealer-harvested credentials can provide threat actors with access to corporate networks, facilitating further intrusion and data exfiltration. Therefore, continued monitoring of corporate domains is highly recommended. Recommendations include ongoing dark web and stealer-log monitoring, proactive credential hygiene checks, password rotation, and reviewing multi-factor authentication status for all accounts. It is also advised to monitor alternate corporate domains and review activity logs for Microsoft 365, VPNs, and remote-access portals.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.