MEMSIC Data Breach

MEMSIC, a US-based semiconductor and sensor manufacturer specializing in MEMS (microelectromechanical systems) technology for automotive, industrial, and consumer electronics markets, was listed as a claimed victim on Abyss’s dark web portal on August 26, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. The claim has not been independently confirmed. Abyss operates at a lower volume compared to larger Ransomware-as-a-Service (RaaS) platforms, with MEMSIC being one of only a handful of named victims within a recent 60-day window. The group has demonstrated a preference for US Manufacturing organizations, particularly those in engineering-intensive and industrial sectors. This focus is likely due to the direct correlation between encrypted systems and halted production, as well as the potential to exfiltrate proprietary technical intellectual property. MEMSIC’s role as a precision sensor manufacturer, supplying components for automotive and industrial control systems, aligns closely with this established targeting pattern.

SOCRadar’s telemetry returned 5 records for memsic[.]com, all classified as employee credentials on third-party external services. The identified endpoints include analytics.zhihuiya.com, which showed a recurring masked @memsic.com user accessed across multiple timestamps, and radanpro[.]com, which contained a distinct masked @memsic.com user. Both identified cases involve @memsic.com corporate credentials appearing on non-corporate external platforms. This pattern is consistent with infostealer malware compromising employee workstations and exfiltrating saved browser credentials. The records span February through May 2026, a three-month period during which the same masked username appeared across different URLs and dates, suggesting a risk of workstation compromise. Five records from two distinct users across a three-month window, all appearing on external platforms, strongly suggest workstation-level compromise rather than credential stuffing against a single service. Abyss and similar threat groups typically source this type of compromised credential data from underground markets. They then validate these credentials against services such as Microsoft 365, VPNs, and remote-access portals to facilitate further intrusion. While these specific records do not confirm this exact intrusion path, they represent a significant instance of credential exposure. Treat identified @memsic.com accounts as high-priority. Cross-reference the affected usernames against internal access logs covering February through May 2026, and verify endpoint security across the machines involved.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.