Excel Cell Electronic Data Breach

Excel Cell Electronic, a manufacturing company based in Taiwan, was identified as a victim of the TheGentlemen ransomware group on July 7, 2026. This listing was discovered via SOCRadar’s Dark Web Monitoring service. The company’s operations in East Asia mark an expansion for the ransomware group, which has been actively targeting the manufacturing sector along with business services and healthcare.

SOCRadar’s analysis of stealer-log telemetry revealed a persistent exposure of credentials for the ece.com.tw domain. This exposure included access to a high-value product lifecycle management (PLM) system and an internal engineering system. The credentials were used across internal subdomains for approximately eighteen months, suggesting a recurring account compromise. The Gentlemen ransomware group commonly utilizes credentials harvested from infostealer logs for initial access, gaining entry to systems like Microsoft 365, VPNs, or remote access portals before deploying their ransomware. While direct use by TheGentlemen is not confirmed, the presence of exposed credentials for critical internal systems represents a significant risk that warrants immediate remediation, including credential rotation and PLM system log scrutiny.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.