Semana Data Breach

Semana, an organization based in Spain, was recently listed by the Qilin ransomware group on its dark web portal on August 19, 2026. SOCRadar’s threat intelligence analysis revealed stealer-log telemetry associated with the domain `semana[.]es`, yielding 19 records that included internal employee accounts and external customer-facing logins. The data suggests a potential compromise occurring just prior to the leak-site listing, indicating that credentials for both internal and external users were exfiltrated. The nature of Semana’s operations, likely involving sensitive customer data or critical business functions, could make it an attractive target for ransomware actors seeking to maximize impact and leverage. The Qilin ransomware group has been actively targeting organizations across Western Europe. Over the preceding 60 days, Qilin claimed approximately 196 victims, with a significant concentration in the United States, Germany, and France. Recent targets in Western Europe include Jone Précision (France), Berlin Brandenburgische Wohnungsbaugenossenschaft (Germany), Connections (Belgium), and INVENSITY (Germany). The addition of Semana to this list signifies Qilin’s continued expansion of its operational footprint, now including Spain, and reinforces the group’s consistent targeting of businesses within this region.

SOCRadar’s threat intelligence platform detected a listing for Semana on the Qilin ransomware group’s dark web portal on August 19, 2026. Concurrently, stealer-log telemetry for the domain `semana[.]es` returned 19 records. These records contained credentials for internal employee accounts as well as external customer-facing logins, dated up to and including the publication date of the listing. The retrieved credentials covered seven distinct employee identities, nine customer accounts, and three corporate accounts. Employee records indicated access to `semana[.]es` itself, along with other platforms such as Salesforce, LinkedIn, and Slack. The customer-tier records pertained to logins for the `semana[.]es` user portals. The data spans a freshness window from July through August 19, 2026, aligning precisely with the day the Qilin group published its listing. The timing and nature of the credential data—encompassing both internal and external accounts exfiltrated on the same day as the leak-site publication—strongly suggest a pre-staging phase for a potential ransomware attack. While this telemetry does not definitively confirm Qilin’s entry point into Semana’s network, it highlights a significant risk. Both employee identity remediation and customer account notification are therefore warranted to mitigate potential fallout from this credential exposure. Continued dark web monitoring for further listings and proactive credential hygiene checks are recommended.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.