ACI Proyectos SAS Data Breach

qilin listed ACI Proyectos SAS, a Colombian project management and engineering consulting firm, on its leak site on 2026-10-10. qilin is one of the most active ransomware operators in the current landscape — 214 victims claimed over the past 60 days across Manufacturing, Technology, and multiple other sectors. Colombia appears in its confirmed Latin American reach alongside Chile. Project data, engineering deliverables, and client contracts are the likely extortion assets. The credential log window is the key risk indicator: 2024-10-24 to 2026-10-04. Nearly two years of continuous credential exposure. This isn’t a fresh breach. Infected endpoints operated undetected for an extended period, and the stolen credentials likely changed hands multiple times before qilin or an affiliated IAB operationalized them.

The stealer-log verdict is severe_exposure_in_sample. All 4 records are Category A — employee credentials on organizational systems — across MS IdP (Microsoft’s identity platform, providing authentication for Microsoft 365 and all connected services) and the corporate mail portal. The credential log window is the key risk indicator: 2024-10-24 to 2026-10-04. Nearly two years of continuous credential exposure. This isn’t a fresh breach. Infected endpoints operated undetected for an extended period, and the stolen credentials likely changed hands multiple times before qilin or an affiliated IAB operationalized them. A two-year Microsoft IdP credential exposure window is not a minor hygiene issue. Every credential within that window should be treated as potentially compromised and rotated immediately. The organization also needs full EDR (endpoint detection and response) coverage to confirm whether infected workstations remain active, and MFA enforcement across all Microsoft-integrated systems to reduce the leverage any stolen credential provides. Client project data — contracts, engineering deliverables, communications — should be audited for unauthorized access during the exposure window.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.