Compunnel Data Breach

Compunnel, a professional services organization based in the United States and listed as “clgroup” on the Inc Ransom portal with the domain compunnel.com, was identified as a victim on the Inc Ransom ransomware group’s dark web portal on August 13, 2026. This discovery was made through SOCRadar’s Dark Web Monitoring service. As a provider of staffing, IT, and workforce solutions, Compunnel operates within a sector that handles extensive employee data and maintains access to client environments, making it a potential target for ransomware groups. The listing aligns with Inc Ransom’s consistent targeting of the professional and business services sector. In the 60 days preceding this listing, Inc Ransom claimed 39 other victims. The group predominantly targets the Professional Services, Healthcare, and Business Services sectors, with a concentration of victims in the United States, Canada, and Australia. Compunnel’s profile as a US-based professional services organization is similar to other recent Inc Ransom victims, including Stuart & Associates Commercial Flooring, Louisville Bar Association, Evangelical Council for Financial Accountability, and Cambria Law Firm. Compunnel’s role as an IT staffing and managed services provider also presents a potential risk of downstream exposure to its client organizations.

SOCRadar’s analysis of stealer-log telemetry revealed a significant exposure related to the compunnel.com domain. The queried sample identified 23 classified records, comprising 10 employee credentials on organization-controlled or identity-linked endpoints, 2 records of external users accessing Compunnel systems, and 6 records of corporate usernames on third-party SaaS platforms. Notably, high-value endpoints such as the Microsoft 365 tenant identity provider (login.microsoftonline.com, with 4 corporate-user records) and internal platforms including the Compunnel portal, service desk, and HR staffing system were observed. The data profile was classified as Mixed, suggesting both workstation-level infections and direct access to corporate identity infrastructure. The log dates range from July 28 to August 13, 2026, indicating a recent and active exposure window that extended up to the day before the listing was published. For ransomware operations, infostealer-harvested credentials represent a common initial access vector. Threat actors or initial access brokers often acquire fresh credential logs from underground marketplaces, validate them, and then use these credentials to access systems like Microsoft 365, VPNs, or remote-access portals before deploying ransomware. While the observed stealer-log data does not definitively confirm that Inc Ransom utilized these specific credentials, the capture of Microsoft 365 tenant credentials within days of the listing date constitutes a high-priority indicator. Given Compunnel’s function as a staffing and IT services provider with extensive client access, the potential for lateral movement into client environments is an additional risk factor that threat intelligence teams should evaluate alongside internal incident response efforts.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.