Idex Group Data Breach

Idex Group, a technology company based in Germany, has been identified as a victim on the dark web portal of the medusalocker ransomware group. The listing was published on August 16, 2026, and was detected by SOCRadar’s Dark Web Monitoring service. This incident places Idex Group among a growing number of entities targeted by medusalocker, underscoring the group’s sustained activity across diverse sectors and geographical locations. Technology companies are often attractive targets due to the critical nature of their data and services, making them vulnerable to ransomware attacks. In the 60 days preceding this listing, medusalocker claimed six other victims through its leak portal. The group predominantly targets the Technology, Transportation, and Manufacturing sectors, with a significant concentration of victims in Canada, South Africa, and France. Recent claims against companies like Twal Family IT Lab, ZT Systems, Thecourierguy, and Bija Industrie illustrate medusalocker’s broad operational scope across various industries and regions. The targeting of Idex Group aligns with the ransomware group’s established pattern of focusing on technology organizations.

SOCRadar’s investigation into initial access vectors via its stealer-log telemetry returned no direct records for the domain idex-group.com within the queried dataset. It is crucial to note that a null result does not definitively confirm the absence of a compromise. The available data represents a paginated sample, which may not encompass all relevant logs. Furthermore, compromised credentials could exist under alternate corporate domains or personal email aliases utilized by Idex Group employees, or they may have been used and subsequently rotated prior to indexing. Therefore, CTI teams should not interpret this negative finding as a conclusive exoneration. Ransomware operations frequently leverage credentials harvested by infostealers as a primary method for initial access. Threat actors or initial access brokers often acquire fresh credential logs from underground marketplaces. These credentials are then validated and used to gain access to systems such as Microsoft 365, VPNs, or remote-access portals, facilitating the subsequent deployment of ransomware. The absence of evidence in the current query does not preclude this pathway; credentials might exist in datasets not covered by this analysis, could have been rotated before they were indexed, or may have been harvested using personal email aliases associated with the organization. Consequently, CTI teams are advised to maintain ongoing dark web and stealer-log monitoring. Proactive measures such as credential hygiene checks, password rotation, and the review of multi-factor authentication settings are recommended. Continued vigilance on alternate corporate domains and thorough examination of Microsoft 365, VPN, and remote-access portal activity remain essential to mitigate potential risks.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.