Aokkef Data Breach

MedusaLocker ransomware has listed Aokkef, a company operating in France, on its dark web portal on September 23, 2026. SOCRadar’s Dark Web Monitoring service detected this listing. Aokkef appeared alongside other European entities, specifically the Czech internet platform seznam[.]cz and the Bulgarian webmail provider abv[.]bg, in what appears to be a coordinated release of victim data. The specific industry of Aokkef was not detailed in the provided source information, limiting further sector-specific analysis. The MedusaLocker group claimed 18 other victims in the 60 days preceding this listing. Their targeting patterns frequently include the Manufacturing, Technology, and general industry sectors. Notably, France has been the group’s most targeted country during this period, with Aokkef’s listing being the fourth French organization attributed to MedusaLocker recently, following victims such as Bija Industrie and Jgsee. This prevalence suggests a particular focus on French entities, underscoring the importance for French companies to audit their remote access infrastructure.

A query conducted for the domain aokkef[.]fr returned no associated stealer-log records. However, this result does not definitively confirm that the organization is unaffected by credential compromise. The infostealer feeds queried represent a specific, bounded portion of available data; credentials may exist under alternative corporate domains, be associated with personal email aliases, or reside within data feeds that were not included in this particular sampling. The absence of evidence in this specific query is not equivalent to evidence of absence. Credentials may have been exfiltrated and subsequently rotated before being indexed, or they might exist in feeds not covered by this analysis. Therefore, a null result in this context should not be interpreted as an all-clear signal. MedusaLocker’s operational tactics often involve leveraging harvested credentials, frequently sourced from underground markets. These credentials are then used for authentication into systems such as VPNs or Microsoft 365 services, paving the way for ransomware deployment. Given these methods, continued monitoring of the dark web and stealer-log feeds, alongside proactive credential hygiene practices such as password rotation and multi-factor authentication review, remain crucial defensive actions.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.