ALPHANUMERIC SYSTEMS, INC. Data Breach

ALPHANUMERIC SYSTEMS, INC. was targeted by the Settra ransomware group, with the incident being identified through SOCRadar’s Dark Web Monitoring and listed on August 19, 2026. As a Managed Service Provider (MSP), Alphanumeric Systems offers IT managed services and technology solutions, meaning its network access to client environments presents a significant risk. A single intrusion into an MSP’s infrastructure can potentially lead to cascading impacts across its entire client portfolio, making such organizations attractive targets for ransomware actors. The August 19, 2026 batch of Settra’s claims also includes M.A.K. Freight Systems (Malaysia, Transportation), Greco Steel Products (Greece, Manufacturing), AMBITION Group (Japan), and West Coast Management and Realty. This diverse group spans four countries and multiple sectors. Settra’s inclusion of a US-based MSP, alongside targets in industrial and services sectors, aligns with the strategy of threat actors who value MSP listings for potential downstream leverage, irrespective of the specific campaign’s theme.

The stealer-log query for alphanumeric[.]com revealed 22 records, comprising 18 employee credentials on organizational systems and 4 corporate credential entries. The affected endpoints include Microsoft Entra ID (login.microsoftonline.com), ConnectWise Manage, and KnowledgeCity. The observed data is fresh, with a timeframe ranging from June 1 to August 10, 2026, meaning the credentials were valid up to nine days prior to the listing date. The focus on ConnectWise Manage is significant due to its role as a Remote Monitoring and Management (RMM) platform. Credentials compromised within this system could grant an attacker extensive access to the endpoints of every client managed by the MSP. The stealer-log data confirms the presence of ConnectWise records within the corpus, and these records are current. While the stealer-log evidence does not definitively confirm that these specific credentials were used by Settra, the combination of 18 employee identities with access to Entra ID and ConnectWise, credentials valid until August 10, and a leak-site listing just nine days later strongly suggests pre-staging for an MSP-targeting operation. Organizations should prioritize rotating ConnectWise credentials and auditing ConnectWise sessions for any non-standard geographies or devices within the June to August 2026 window.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.