KMLS Data Breach

KMLS, a German organization identified by the domain kmls[.]de, has been listed on the dark web portal of the qilin ransomware group on September 20, 2026. The qilin group has demonstrated a high operational tempo, claiming 243 victims in the preceding 60 days, making it one of the most prolific active ransomware operations. Their targeting predominantly focuses on organizations in the United States, Germany, and the United Kingdom. The most frequently affected industries include Manufacturing, Professional Services, and a broad category labeled as ‘Other’. Germany, in particular, represents a consistent target for qilin’s activities, suggesting a strategic focus on this region. The qilin ransomware group’s operational strategy appears to involve exploiting compromised credentials to gain initial access. The group’s recent victimology indicates a pattern of targeting specific countries and industries, and KMLS fits within this established pattern due to its German location and classification under ‘Other’ industries. This victimization aligns with qilin’s broader targeting trends, indicating that the group is actively pursuing entities within its preferred geographic and industrial sectors.

Stealer-log analysis for the domain kmls[.]de revealed a significant number of compromised credentials. Specifically, 25 records were identified, including two employee accounts on internal organizational systems and 23 corporate credentials linked to external services. The compromised credentials targeted high-value infrastructure, with notable entries related to login[.]microsoftonline[.]com and account[.]live[.]com/password/reset, which are integral components of Microsoft’s identity management systems. The observed access profile indicates workstation compromise, with all identified activity occurring within September 2026, aligning precisely with the date of the qilin group’s claim. The presence of 23 compromised corporate credentials for Microsoft identity infrastructure represents a substantial risk. Access to Microsoft 365 environments through these credentials can facilitate extensive lateral movement, potentially granting attackers access to email, SharePoint, Teams, and cloud storage services from a single compromised account. This broad access surface could be leveraged by the qilin group for further exploitation and ransomware deployment. Given the high density of compromised credentials, it is crucial to investigate whether any of the implicated accounts held administrative privileges. A thorough audit of Entra ID sign-in logs for anomalous activity during the September 2026 timeframe is highly recommended. Continued dark web monitoring and proactive credential hygiene measures, including password rotation and multi-factor authentication review, are essential to mitigate the risk of further compromise.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.