Jani-King Data Breach

Jani-King, a business services company based in the United States, has been identified as a victim on the Booba Project threat group’s dark web portal, with the listing published on July 15, 2026. This discovery was made by SOCRadar’s Dark Web Monitoring service. Operating within the business services sector with a franchise-based commercial cleaning model, Jani-King is among the more prominent entities listed on the Booba Project’s portal, which has featured relatively few victims to date. In the 60 days preceding this listing, the Booba Project mentioned only one other victim on its leak portal, indicating it is a new and low-volume threat actor. Both victims during this period belonged to the business services sector, with one based in the United States and the other in Russia. Given the small sample size, it is difficult to establish a firm pattern of targeting. Jani-King’s profile, based in the US and within business services, aligns with an actor still developing its operational footprint rather than a group with a specific targeting focus.

SOCRadar’s analysis of stealer-log telemetry indicated a credential exposure related to the janiking.com domain. The query for the domain did not reveal any internal employee credentials. However, it did find credentials for three external users on the organization’s franchise portal and four corporate usernames associated with third-party services. This pattern suggests a potential compromise of workstations and exposure of franchisee accounts, with the franchise portal logins being particularly noteworthy. The exposed credentials belonged to external users and franchisees, not directly to corporate employees. One external account was observed across multiple timestamps on Jani-King owned URLs, highlighting a persistent exposure window from July 2025 to March 2026, suggesting credentials were not rotated. For threat actors like the Booba Project, credentials harvested by infostealers can serve as a primary method for initial access. Threat actors or initial access brokers acquire fresh credential logs from underground marketplaces, validate corporate login details, and subsequently use them to access portals, VPNs, or SaaS platforms before initiating wider intrusions. However, the Booba Project’s operational methods are not yet fully characterized. The observed stealer-log evidence should be interpreted as credential exposure coincident with the leak site listing; its direct role in this specific incident cannot be confirmed. Despite the lack of direct confirmation, CTI teams should consider the exposed franchise portal and corporate-on-third-party accounts as potential access vectors requiring auditing. Specifically, the recurring long-tail credentials that were exposed should be prioritized for rotation. Continued dark web monitoring and proactive credential hygiene checks are recommended.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.