Hemmersbach GmbH & Co. KG Data Breach

Hemmersbach GmbH & Co. KG, a business services company based in Germany, has been listed by the Qilin ransomware group on their dark web portal. The listing, published on June 30, 2026, was identified by SOCRadar’s Dark Web Monitoring service. The group has been actively targeting organizations in the business services, manufacturing, and healthcare sectors, with a strong presence in the United States, Australia, and the United Kingdom. Hemmersbach’s profile aligns with Qilin’s pattern of targeting German companies within the business services sector.

SOCRadar’s analysis of stealer-log telemetry revealed a concerning exposure for the hemmersbach.com domain. The data indicated the compromise of two internal employee credentials, fifteen non-corporate accounts on organization-owned domains, and eight corporate credentials on third-party services. Notably, corporate credentials for Microsoft Entra ID and an internal Keycloak SSO/identity-provider endpoint were exposed, alongside corporate emails on external services. The compromise data clustered tightly between June 28 and June 30, 2026, suggesting a recent or synchronized credential dump. These findings are consistent with Qilin’s modus operandi, where infostealer-harvested credentials are used for initial access via platforms like Microsoft 365, VPNs, or remote access portals. While direct confirmation of Qilin’s use of these credentials in this incident is lacking, the timing and nature of the exposed credentials strongly indicate direct-identity access exploited by the ransomware group. Immediate actions recommended include credential resets, session invalidation, endpoint forensics, and MFA enforcement.