Asia Era One Data Breach

Eclipse, a ransomware group, has listed Asia Era One, an Indian television news broadcaster, on its dark web leak site on October 5, 2026. The group claims to have gained access to corporate systems and threatens to publish stolen data. This incident is particularly notable due to SOCRadar’s CTI findings of 22 compromised credential records associated with asiaeraone[.]com, dating from December 2024 to September 2026. This indicates a nearly two-year period of credential leakage preceding the ransomware listing, significantly altering the typical response parameters for such events. In the past 60 days, Eclipse has claimed 11 victims across India, Singapore, and the United States, primarily targeting the technology and hospitality sectors. Notable past victims include ETNA Software, The Japan Times, Rosello et Fils, and Dublin City Schools GA. The group’s consistent targeting of South Asian entities, particularly Indian media and technology companies, suggests a deliberate and focused operational strategy. Asia Era One’s inclusion aligns with this established pattern of targeting by the Eclipse ransomware group.

SOCRadar’s analysis of stealer logs identified 22 compromised records specifically for the domain asiaeraone[.]com. These records encompass a range of sensitive data, including 17 corporate credential logs which are vital for authentication such as Active Directory and VPN access. Additionally, one business application credential, three workstation compromise artifacts indicating endpoint infections beyond mere exposed passwords, and one URL-based credential were found. These discovered records span a significant timeframe, from December 2024 to September 2026. The implications of these findings are substantial. The presence of 22 compromised records, extending over a period of 21 months prior to the ransomware group’s leak-site listing, suggests a prolonged and deep-seated intrusion. This extended exposure window indicates that threat actors likely had sustained access for reconnaissance and potential lateral movement, rather than a more opportunistic or recent compromise. The nature of the compromised data points towards a deliberate, long-term infiltration strategy by adversaries. The presence of corporate credentials and workstation compromise artifacts underscores the potential for adversaries to leverage this information for further network access and privilege escalation. For a media company like Asia Era One, this could translate to access to sensitive journalistic sources, broadcasting infrastructure, and content production systems. The extended exposure window suggests that historical data and communications may have been compromised, posing a significant risk to operational integrity and journalistic confidentiality. Immediate priorities should include a thorough forensic investigation, comprehensive credential rotation across all affected systems, reporting to India’s CERT-In, and an assessment of any applicable press law obligations.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.