WRT World Enterprises Data Breach

WRT World Enterprises, a business services organization based in the United States, has been identified as a victim of the m3rx ransomware group. The perpetrators published the information on their dark web leak portal on July 12, 2026. SOCRadar’s Dark Web Monitoring service flagged this listing. The company operates in the Business Services sector, and they are not an outlier in m3rx’s targeting patterns, as the group frequently targets companies in the United States and within the Business Services industry.

Initial access analysis using SOCRadar’s stealer-log telemetry revealed a potential exposure for the wrtworld.com domain. Corporate usernames were found on third-party consumer and SaaS services, suggesting a possible employee endpoint compromise via stealer malware. This pattern is consistent with how ransomware groups like m3rx acquire initial access, often by sourcing credentials from stolen logs, validating them, and then accessing corporate networks to deploy ransomware. While this doesn’t confirm the use of these specific credentials by m3rx, it points to a credible starting point for incident responders to investigate. Defenders are advised to prioritize credential rotation and endpoint forensics for affected accounts.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.