Sintax Data Breach

Sintax, a technology company based in Belgium, was identified as a victim of the qilin ransomware group on July 9, 2026. The claim was published on the group’s dark web portal, as detected by SOCRadar’s Dark Web Monitoring service. Sintax operates within the technology sector and is associated with a Belgian country-code domain. This listing adds a European technology entity to the qilin group’s victim base, which has historically shown a strong concentration of targets in the United States. qilin has been a highly active ransomware operation in the 60 days prior to this listing, claiming 146 victims. The group typically targets the business services, manufacturing, and healthcare sectors, with a geographical focus on the United States, Australia, and the United Kingdom. While Sintax aligns with qilin’s pattern of targeting technology companies, its Belgian origin offers a slight geographic divergence from the group’s usual US-centric operations.

SOCRadar’s analysis of stealer-log telemetry for sintax.be in the preceding 60 days yielded no direct records. However, this absence does not confirm a lack of compromise. The search was limited to a partial sample from a single source, and exposure can occur through alternate corporate domains, personal email addresses used for work, or logs that were rotated and indexed after the data theft. The use of country-code domains can also fragment coverage, necessitating caution despite a clean query result. For ransomware groups like qilin, credentials harvested by info-stealers are a known method of gaining initial access. Operators or brokers source credentials from underground markets, validate them for corporate use (e.g., Microsoft 365, VPN, RDP), and then deploy ransomware. The lack of evidence in the current STEALER log telemetry does not discount this attack vector, as credentials might have appeared in other feeds, been used and rotated before indexing, or acquired via personal email aliases. CTI teams are advised to maintain vigilance and proactive credential hygiene checks rather than relying on a null query for reassurance.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.