Microphase Corporation Data Breach

Microphase Corporation, a manufacturing company based in the United States, has been identified as a victim by the LockBit5 ransomware group. The listing appeared on the group’s dark web portal on August 3, 2026, and was detected by SOCRadar’s Dark Web Monitoring service. The company operates within the manufacturing sector in the United States, a vertical that is frequently targeted by the LockBit5 group. This specific listing was part of a larger batch published on the same day, indicating a potentially broad campaign by the ransomware operation. In the 60 days preceding this listing, LockBit5 claimed approximately 76 other victims. The group shows a consistent targeting pattern within the Manufacturing, Business Services, and Hospitality and Tourism industries. Key victim countries for LockBit5 include Brazil, the United States, and Germany. Other manufacturing organizations that have been listed by LockBit5, sharing a similar profile with Microphase Corporation and operating across various regions, include Venelectronics, Union Chemical, Param Packaging, and DRC. The targeting of a US-based manufacturer aligns with LockBit5’s prominent focus on both the manufacturing sector and the United States geographically.

SOCRadar’s analysis of stealer-log telemetry did not return any records associated with the domain microphase.com within the queried dataset. It is important to note that a null result does not conclusively indicate that the organization is unaffected by a compromise. The query covered a paginated and limited sample of available data, and credentials could exist under alternate corporate domains, subsidiary infrastructure, or through credentials harvested using personal email aliases, none of which would be captured in this specific lookup. For specialist manufacturers with a limited public-facing SaaS footprint, such null results are common and do not necessarily represent a clean security posture. For ransomware groups like LockBit5, credentials obtained through infostealers are a well-documented method for initial access. Threat actors or initial access brokers often source these credentials from underground marketplaces, validate their authenticity, and then use them to gain unauthorized access to systems via Microsoft 365, VPNs, or remote-access portals, ultimately leading to ransomware deployment. The absence of immediate evidence in this query does not eliminate this possibility. The credentials may have appeared in data feeds not included in this dataset, been utilized and rotated before indexing, or been harvested using personal email addresses. Cybersecurity threat intelligence teams should prioritize ongoing monitoring and proactive credential hygiene checks rather than interpreting a null query as confirmation of no compromise.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.