EXEL Data Breach

On August 19, 2026, SOCRadar’s Dark Web Monitoring identified EXEL, a technology company based in Canada, as a victim listed on the INC Ransom dark web leak site. This listing places EXEL within a wave of recent activity from the INC Ransom group, which also claimed victims in the US and Thailand during the same period. The INC Ransom operation is known for targeting mid-market companies, typically those with 50 to 500 employees. This size profile suggests organizations that possess significant data assets yet may experience considerable disruption from an unexpected operational outage, thereby increasing the likelihood of payment to resolve the incident. INC Ransom operates as a Ransomware-as-a-Service (RaaS) model and has a discernible pattern of targeting North American technology and professional services firms. The current batch of victims, including EXEL, aligns with this modus operandi. Other companies listed in this publication include CDGARVINLAW (US, Professional Services), Universal Plastics Inc. (US, Manufacturing), and BANGKOKCABLE (Thailand, Manufacturing). The group’s consistent focus on these sectors and geographic regions indicates a strategic approach to identifying and exploiting vulnerabilities within specific industry verticals and markets.

SOCRadar’s analysis of stealer-log telemetry for EXEL, specifically targeting exel[.]com and related domains, yielded no records within the queried dataset. It is important to note that the absence of detected records does not definitively confirm that the organization is unaffected. Credentials may exist within other data feeds not included in this specific query, or they might be associated with personal email aliases that were not sampled. Furthermore, any found credentials may have been used and subsequently rotated before their inclusion in the indexed dataset, or the data may not yet have been indexed by the queried sources. Therefore, this null result represents a bounded observation and not a complete clearance. The INC Ransom group typically gains initial access through credentials harvested by infostealers. These stolen credentials, often acquired from underground marketplaces, are then validated. Attackers use these valid corporate accounts to access systems such as Microsoft 365, VPNs, or remote-access portals. Once inside, they proceed with ransomware deployment. This method of initial access underscores the critical importance of robust credential hygiene and monitoring to disrupt the early stages of an attack. Given the operational methodology of INC Ransom, organizations are advised to maintain continuous dark web monitoring and conduct proactive checks on credential hygiene. Implementing password rotation policies and reviewing multi-factor authentication configurations are essential defensive measures. Additionally, vigilance in monitoring Microsoft 365, VPN, and remote-access activity can help detect and deter unauthorized access attempts facilitated by compromised credentials.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.