Adventus Data Breach

Adventus, a company operating out of Singapore, has been identified as a victim on the LockBit5 ransomware group’s dark web portal, with the listing published on August 3, 2026. This discovery was made by SOCRadar’s Dark Web Monitoring service. While the company’s specific sector is not detailed in SOCRadar’s data, its listing appeared within a substantial single-day release of LockBit5 claims that spanned multiple continents. Notably, this represents the only claim targeting an organization in Singapore by LockBit5 within the observed recent period. In the 60 days preceding this listing, LockBit5 claimed 76 other victims. The group frequently targets organizations within the Manufacturing, Business Services, and Hospitality and Tourism sectors. Its primary victim countries are Brazil, the United States, and Germany, with Thailand being the most represented nation in Southeast Asia. Previous LockBit5 victims that share similarities with Adventus in terms of regional and commercial services include SCB Group, Ravagnan Group, Media Service Maastricht, and ComTRI GmbH. The presence of only one victim from Singapore in this timeframe makes Adventus a geographic anomaly rather than a typical target for LockBit5.

SOCRadar’s analysis of stealer-log telemetry identified a significant exposure related to the adventusasia.com domain. The query revealed twenty-five records, with sixteen classified as employee credentials on organization-owned systems, four as corporate identities on third-party services, two for external users, and one unclassified. The exposure is notable for its breadth and sensitivity, affecting the organization’s Microsoft identity provider tenant, mail infrastructure, HR and provisioning platform, endpoint security console, remote-access tool, and a third-party single sign-on service. A single employee identity accounted for nine records across identity, productivity, security, and remote-access platforms, suggesting a potential compromise of a widely provisioned or high-privilege user’s workstation. The data captured spans from June 19, 2026, to July 28, 2026, with a clear profile indicating corporate intrusion risk. Two records on organization-owned URLs utilized a non-corporate domain, suggesting a potential partner or outsourced support relationship that requires further investigation. For ransomware groups like LockBit5, credentials harvested by infostealers are a known vector for initial access. Threat actors or initial access brokers acquire fresh logs from underground marketplaces, validate corporate credentials, and then use them to access systems such as Microsoft 365, VPNs, or remote-access portals to deploy ransomware. While the stealer-log data does not definitively confirm that these specific credentials were used by LockBit5 to compromise Adventus, the pattern observed aligns with the typical kill chain for such incidents. The proximity of harvested credentials across identity, mail, and security tooling platforms within six weeks of the leak-site listing strengthens this possibility. Standard mitigation would involve rotating credentials for all sixteen exposed identities, with a priority on those related to identity management, email, and security operations.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.