Medochemie Data Breach

Qilin claimed Medochemie, a Cyprus-based pharmaceutical manufacturer, on its dark web portal on August 19, 2026. Medochemie’s international distribution across the Middle East, Africa, and CIS markets extends the potential impact of any data exfiltration beyond its home country. Over the past 60 days, Qilin has claimed approximately 196 victims, with Manufacturing, Professional Services, and Technology as its primary sector targets. The group predominantly targets organizations in the United States, Germany, and France. Medochemie aligns with Qilin’s pattern of targeting mid-sized international organizations outside these primary clusters when data leverage is deemed sufficient. Recent comparable listings include Coface (Italy, Financial Services), Megawide (Philippines, Manufacturing), AGUNSA (Chile, Transportation), and Loescher editore Torino (Italy, Education).

Stealer-log telemetry for medochemie[.]com returned nine records, comprising two employee identities and seven corporate credential entries. The employee records indicate access to Microsoft 365 identity infrastructure (login.microsoftonline[.]com) and the organization’s own FTP server (ftp.medochemie[.]com). Three entries reference crosoftonline[.]com, a known typosquatted domain for Microsoft’s sign-in page, suggesting a potential phishing event targeting Medochemie employees or a credential interception relay. The credential data spans June 2024 to July 2026, indicating unrotated accounts that have been exposed over a two-year period. The presence of crosoftonline[.]com entries is a significant finding, as it may indicate that phishing infrastructure was used against the organization. The captured Microsoft 365 credentials from such a channel could still be valid. Combined with access to the organization’s FTP server, this presents a substantial attack surface for a ransomware group like Qilin, as it involves both direct organizational infrastructure and cloud identity credentials that are potentially accessible. Revoke and audit all active sessions tied to the identified accounts, prioritizing Microsoft 365 identities from the June 2024–July 2026 window. Investigate the crosoftonline[.]com entries for evidence of phishing infrastructure targeting the organization. Verify whether the FTP server at ftp.medochemie[.]com remains externally accessible.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.