Estech Data Breach

Estech, a Germany-based firm specializing in engineering design services, has been identified as a victim of the Qilin ransomware group. The threat actor listed Estech on its dark web leak site on August 19, 2026. This incident marks Estech as one of several German technology targets within Qilin’s current operational campaign. SOCRadar’s Dark Web Monitoring service detected this listing, highlighting a concerning trend of ransomware actors targeting entities within the technology and engineering sectors, particularly in Germany. Qilin has demonstrated significant activity in the recent past, claiming approximately 196 victims in the 60 days preceding this listing. The group’s primary targets include the Manufacturing, Professional Services, and Technology industries, with the United States, Germany, and France being the most frequently targeted countries. Estech’s inclusion aligns with Qilin’s established patterns, especially given the overlap with German and technology-focused victims like INVENSITY, Berlin Brandenburgische Wohnungsbaugenossenschaft, Botek (manufacturing), and MOSAID Technologies (Canada, technology).

SOCRadar’s analysis of stealer-log telemetry for the domain estech-design[.]com revealed 26 records. A single account, eva****d@estech-design[.]com, was predominantly featured, appearing across multiple platforms including Microsoft Entra ID (login.microsoftonline[.]com), Solidworks SSO (login.solidworks[.]com), Estech’s own mail server (mail.estech-design[.]com), Adobe Creative Cloud, Dropbox, and PartCommunity. Of these records, five were classified as employee credentials on internal organizational systems, while the remaining nineteen indicated the reuse of this same account across various third-party services. The geographic distribution of access attempts associated with this account spanned Nigeria, China, the Czech Republic, the Philippines, Romania, Brazil, and France. This wide geographical spread suggests active credential replay rather than a dormant infection. The identified freshness window for these credentials ranges from March to August 10, 2026, which is nine days prior to Qilin’s public listing of Estech. This persistent access across multiple critical services, including email and identity management, from various global locations, strongly indicates a pre-compromise scenario and a high-confidence signal of potential intrusion.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.