Indian Motos Inmot Data Breach

On July 30, 2026, the Qilin ransomware group listed Indian Motos Inmot on its leak site. Indian Motos Inmot is a manufacturing company based in Ecuador. This listing was identified by SOCRadar’s Dark Web Monitoring. The manufacturing sector has been a consistent target for Qilin, and this incident marks a new geographic focus for the group in Ecuador. Qilin has been particularly active recently, claiming 122 other victims within the preceding 60 days, making it one of the busiest ransomware operations. The group’s primary targets are often found in the Business Services, Manufacturing, and Technology sectors. Historically, Qilin has concentrated its attacks in the United States, France, and Germany. Recent victims in the manufacturing industry that align with Indian Motos Inmot’s profile include Groupe Fenwick, GURR Abdichtungstechnik GmbH, Guntert & Zimmerman, and Machinerie P&W.

The dark web listing for Indian Motos Inmot revealed a severe situation, with 25 records associated with the domain inmot[.]com[.]ec. These records included multiple employee email addresses under the @inmot[.]com[.]ec domain. Six of these records were employee credentials tied to identity infrastructure, specifically mentioning sign-in endpoints for Microsoft Entra and Google Workspace. Additionally, ten corporate credentials were found on third-party services, along with corporate-owned Curbe portals. The analysis also flagged one administrator-level account and one heavily reused employee account appearing across identity, SaaS, and internal systems. The timeframe for these exposed credentials is broad, ranging from December 2024 through late July 2026, with recent exploitation noted on critical identity provider (IdP) endpoints. Infostealer logs are a recognized method of initial access for the Qilin ransomware group. Threat actors or access brokers typically acquire these logs, validate the captured corporate credentials, and then use them to gain unauthorized entry into systems like Microsoft 365, VPNs, or remote-access portals before deploying ransomware. While these specific logs do not definitively confirm that Qilin utilized these exact credentials to compromise Indian Motos Inmot, the exposure of multiple employee identities on platforms like Entra and Google Workspace aligns precisely with the attack profile exploited by such threats. Given the findings, it is crucial for Indian Motos Inmot to take immediate action. This includes resetting passwords for all affected accounts, revoking active sessions and tokens across both Microsoft Entra and Google Workspace identity tenants, and performing a thorough forensic review of sign-in logs. Continued monitoring of dark web and stealer-log feeds is also recommended.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.