Open Sports Data Breach

Qilin ransomware has targeted Open Sports, an Argentine company operating in the retail and e-commerce sectors. The incident was identified on August 27, 2026, through SOCRadar’s Dark Web Monitoring service. This listing is noteworthy as Qilin’s typical operational focus has been in the US, Germany, and Italy, making this Latin American retail victim a deviation from their usual targeting patterns. Open Sports was listed alongside other consumer-facing retailers, suggesting an opportunistic approach by Qilin towards the retail sector, in addition to their established focus on manufacturing. In the 60 days preceding this listing, Qilin claimed a total of 234 victims. While the group has a significant presence in the manufacturing industry, their recent activity indicates an expansion into other consumer-facing sectors. The inclusion of victims like Kling Automaten, Thrifty Building Supply, WEBA Meubelen, and Price Shoes alongside Open Sports suggests a broader strategy targeting retail businesses. This diversified targeting reflects a potential opportunistic campaign by Qilin, aiming to capitalize on vulnerabilities across various industries, including retail, which has historically been a lucrative target for ransomware groups.

SOCRadar’s investigation into Open Sports involved a query against the domain opensports[.]com[.]ar. This query yielded 25 records, specifically identifying customer or third-party accounts associated with the company’s customer authentication and account-creation endpoints. The timestamps for these records range from August 26 to August 28, 2026, which directly aligns with the timeframe of the reported ransomware incident. Importantly, no employee or corporate-domain credentials were found within this particular dataset slice. The concentration of compromised records on customer-facing infrastructure, rather than corporate or employee credentials, suggests that the observed activity may be related to post-breach credential use on consumer endpoints. This does not rule out the possibility of a broader corporate intrusion. Employee credentials, if compromised, might reside in a different data set or be associated with a different subdomain. Forensic investigations should therefore extend to other query layers to thoroughly examine potential compromise of staff identities. Furthermore, the activity observed on the August 26–28 customer-authentication endpoints warrants separate investigation for signs of automated scraping or credential stuffing occurring during the incident window. Understanding the nature of this customer data exposure is crucial for assessing the full scope of the incident and its potential impact on Open Sports.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.