LD Constructora Data Breach

qilin listed LD Constructora, a Chilean construction company, on its leak site on October 10, 2026. This type of company is a frequent target for qilin. In the past 60 days, qilin has claimed 214 victims globally. While the group primarily targets the US, UK, and Germany, it has consistently maintained a presence in Latin America, with Colombia and Chile appearing in its victim set. The stealer-log analysis revealed 25 records related to LD Constructora, collected between August 9 and October 2, 2026. This timeframe precedes the leak site listing, which is consistent with the typical operational cycle of initial access brokers (IABs) selling credentials and qilin affiliates subsequently using them. The 11 employee credentials found on Microsoft Identity Provider (MS IdP) systems offer direct access to the company’s Microsoft 365 environment. Additionally, 14 corporate accounts on third-party services, including Autodesk, Google Workspace, and Apple ID, were exposed. These accounts, particularly those on Autodesk, a dominant Building Information Modeling (BIM) platform in construction, could contain sensitive project blueprints, contracts, and client data.

The stealer-log analysis for LD Constructora indicated a severe exposure in the sampled data. A sample of 25 records was analyzed, categorized as follows: 11 employee credentials associated with organizational systems (Category A), all of which were found on MS IdP. Furthermore, 14 corporate accounts on third-party services (Category C) were identified, including credentials for Autodesk, Google Workspace, and Apple ID. The collected data spans from August 9, 2026, to October 2, 2026, preceding the ransom group’s leak site listing on October 10, 2026. This temporal gap aligns with common tactics where credentials are first compromised and then sold via IABs before being utilized by ransomware groups like qilin. The exposure of 11 MS IdP credentials provides potential direct access to LD Constructora’s Microsoft 365 environment. The 14 exposed accounts on third-party services, specifically Autodesk, a key BIM platform in the construction industry, could compromise sensitive information such as project blueprints, contracts, and client data. Construction companies are frequent targets for infostealer malware due to the prevalence of trojanized design software and CAD plugin installers within the industry. These infections can lead to the exfiltration of browser-stored credentials for various cloud services accessed by the workstation. The identified exposure of LD Constructora’s accounts across Microsoft, Autodesk, Google, and Apple aligns with this typical pattern. The period between credential harvesting and the ransomware listing suggests a standard pipeline involving credential sales and subsequent operationalization by ransomware affiliates. Continued monitoring of dark web and stealer-log feeds for LD Constructora is recommended. Proactive credential hygiene checks, including password rotation and multi-factor authentication review, are advised. Additionally, vigilance regarding activity on Microsoft 365, Autodesk, Google Workspace, and Apple ID accounts, as well as monitoring for any related corporate domains, could mitigate further risks.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.