Tat Fung Textile Co., Ltd. Data Breach

Orova listed Tat Fung Textile Co., Ltd., a Hong Kong-based manufacturer, on its dark web portal on August 4, 2026. SOCRadar’s Dark Web Monitoring service detected this listing. The manufacturing sector is a frequent target for ransomware attacks due to the presence of both operational technology and standard IT infrastructure, as well as the critical nature of supplier relationships, making these systems valuable targets for intrusion. In the 60 days preceding this listing, Orova claimed 23 other victims in a single batch on August 4, suggesting this wave represents an initial push rather than an established operational cadence. The group primarily targets the healthcare, manufacturing, and financial services sectors, with a significant portion of its victims remaining unclassified. Key victim countries include the United States, Hong Kong, and Taiwan. Tat Fung Textile Co., Ltd. is part of a notable cluster of Hong Kong-based entities, including Global Friction Products, Inc., SBI Manufacturing, JK Capital Management Limited, and Sanrio Hong Kong Co., Ltd., which may indicate a centralized access source for this wave.

Unlike many other victims listed in the same batch, Tat Fung Textile Co., Ltd. exhibits a significant exposure in stealer-log data. The queried sample revealed approximately twenty records related to the company’s corporate identity infrastructure, organizational web assets, and third-party services. These records include two instances of corporate domain credentials associated with a Microsoft identity provider endpoint, seven instances of non-corporate or customer-type accounts linked to organization-owned URLs, and two instances of corporate accounts authenticating to an external SaaS support platform. The profile of these leaked credentials is mixed. The records associated with the Microsoft identity provider suggest a risk of corporate intrusion, while the SaaS platform and organizational URL records point towards potential workstation compromises. Both types of exposures are consistent with the sampled data. The timestamps for these credentials range from January 2024 to July 31, 2026, with no evidence of rotation during this period. Notably, the most recent credential entries were captured just days before the Orova listing, highlighting the timeliness of the threat. The stealer-log evidence, while not definitively confirming the use of these specific credentials by Orova, aligns with the typical intrusion lifecycle for such incidents. The presence of corporate identity credentials that have remained unrotated for over a year, coupled with recent capture activity immediately preceding the leak-site listing, indicates a high level of access readiness. This pattern suggests that the credential exposure serves as an indicator of potential vulnerability and an enabling factor for subsequent attacks, rather than merely an artifact of an already completed intrusion. Given this, priority should be placed on addressing the Microsoft identity-provider records by rotating affected corporate credentials, verifying MFA coverage, and reviewing authentication logs for the identity endpoint. Furthermore, credential hygiene checks should be extended to the external SaaS support platform and the customer-facing accounts on organization-owned URLs. Continuous monitoring of the domain tatfung-tex[.]com is also recommended.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.