Recsa Data Breach

Recsa, an organization based in Costa Rica, was listed as a victim by the Qilin ransomware group on July 22, 2026. This identification was made through SOCRadar’s Dark Web Monitoring service. While the specific industry of Recsa was not detailed beyond its location in Costa Rica, its appearance on the Qilin leak portal represents a less common Central American victim among Qilin’s predominantly US and Western-European target base. This placement suggests Recsa, despite its geographic location, aligns with patterns that may attract ransomware or extortion activity. In the 60 days leading up to this listing, Qilin reported 126 other victims on its leak portal. The group primarily targets organizations in the business services, manufacturing, and healthcare sectors. Its victims are predominantly located in the United States, Australia, and Spain. Other recent Qilin victims that share some similarities with Recsa’s profile, such as those located in Latin America or nearby regions, include Postres Reina, Associated Theatrical Contractors, Don Tortaco Mexican Grill, and Eana. Recsa’s inclusion, therefore, fits within the group’s occasional targeting of Latin American entities, rather than reflecting its dominant focus on US and European targets.

SOCRadar’s analysis of stealer-log telemetry against the recsa.com domain revealed a significant exposure of credentials. Approximately twenty-five records were found in the queried sample, all containing corporate usernames associated with either employee credentials on internal systems or corporate users on third-party services. These compromised credentials were tied to critical and high-value infrastructure, including Microsoft Entra ID single sign-on, a backup platform, a password vault and privileged-access solution, an internal corporate portal, and various corporate SaaS applications. The presence of recurring usernames across multiple services suggests the compromise of one or more endpoints with extensive access. The observed credential exposure points to a corporate intrusion risk with a freshness window ranging from mid-June to mid-July 2026. For ransomware groups like Qilin, credentials harvested by infostealers represent a common vector for initial access. Threat actors or initial access brokers typically acquire fresh credential logs from underground marketplaces, validate them, and then use them to infiltrate systems through platforms such as Microsoft 365, VPNs, or remote access portals, subsequently deploying ransomware. While this specific stealer-log evidence does not definitively confirm that these credentials were used by Qilin for an intrusion, the exposure of identity management, backup, and privileged access systems is a pattern frequently preceding ransomware attacks. This situation makes immediate credential resets, enforcement of multi-factor authentication, isolation of backups, and thorough endpoint forensics urgent priorities for organizations exhibiting this profile.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.