Charter Township of Commerce Data Breach

The Charter Township of Commerce, a local government authority in Oakland County, Michigan, United States, was listed on Booba Project’s dark-web leak portal on October 27, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. The township provides municipal services — public works, parks, building and planning, and community services — to Commerce Township residents through its commercetwp[.]com platform. The listing is part of Booba Project’s October 27 batch, which targeted multiple US local government entities simultaneously. Municipal authorities of this kind hold resident records, operational data, and service platform access, making local government infrastructure a recurring extortion target. Booba Project has claimed 25 victims in the past 60 days. Its primary targeted sectors are Healthcare, Education, and Government & Defense, with primary geographies of the United States, Canada, and Pakistan. Other Booba Project government-sector listings from this period include Washington County, The Merrimack County, FUNAP (Brazil), and City of Big Spring — all added in the same October 27 batch. The Charter Township of Commerce fits squarely within the group’s government-sector and United States-focused targeting pattern, and the simultaneous listing of multiple US local government entities suggests coordinated targeting or shared initial-access infrastructure.

SOCRadar’s credential telemetry pipeline returned no records for commercetwp[.]com. However, this null result should be interpreted carefully rather than as evidence that the township is unaffected. Local government entities frequently operate mixed IT environments that may not surface cleanly in commercial credential telemetry. Credentials harvested under alternate domains, departmental subdomains, or personal email aliases used on municipal networks may not appear in this dataset, meaning exposure could exist outside the queried records. Credentials may also have surfaced in feeds outside this dataset, been used and rotated before indexing, or been harvested under personal email aliases. Where infostealer-harvested credentials exist, they may support broader intrusion operations, potentially enabling access to corporate or municipal accounts such as email, VPN gateways, and remote-access portals that ransomware operators can leverage — although this specific access method has not been confirmed for this incident. CTI teams and township IT staff should expand credential monitoring to alternate domain signatures and enforce MFA on VPN gateways, email systems, and municipal service platforms. Continued dark web and stealer-log monitoring, proactive credential-hygiene checks, password rotation, and review of Microsoft 365, VPN, and remote-access activity are warranted. A null credential query alongside a confirmed ransomware listing is not exoneration.