COMPUTER TASK GROUP Inc. Data Breach

Booba Project listed COMPUTER TASK GROUP Inc. (CTG) on its dark web victim site on 2026-11-10, in a listing identified by SOCRadar’s dark web monitoring. CTG is a major US IT services and staffing company, and its appearance on the leak site marks a significant departure from Booba Project’s usual healthcare, government, and education targets. The enterprise IT services and technology consulting sector carries client access credentials, making a successful breach against a firm positioned in CTG’s line of business particularly high-value for extortion. Booba Project has listed approximately 20 victims in the past 60 days, primarily government, education, and healthcare organizations in the US. CTG’s listing therefore represents a notable expansion into enterprise IT services and technology consulting, extending a victim profile otherwise dominated by public sector, healthcare, and education entities into a new industry. The US-based victim is consistent with the group’s recent geographic focus, but the sector deviation makes the CTG listing stand out within the group’s current campaign and suggests its targeting scope may be broadening.

SOCRadar’s stealer-log correlation returned a severe finding: 14 credential records with active exposure windows as recent as 2026-11-10, the same day as the Booba Project listing. The credential breakdown comprises 9 employee records (Category A), 2 customer or supplier records (Category B), and 3 corporate user records on third-party services (Category C). Systems identified in the infostealer dataset include webmail.ctg[.]com/OWA, Microsoft Live (login.live[.]com), and Webex (globalpage-prod.webex[.]com), along with internal platforms including intranet-eu.ctg[.]com, the HR system ctgwis.ctg[.]com, and ctgcentral.ctg[.]com. The concentration of Category A (employee) credentials across multiple internal and enterprise platforms, with the most recent exposure dated 2026-11-10, creates an extremely high-probability correlation between infostealer compromise and the Booba Project listing. This alignment is significant because Booba Project leverages infostealer-sourced credentials — Lumma, RedLine, Stealc — circulating through dark web markets and Telegram as a primary access path. IT services companies operating enterprise client portals, internal collaboration platforms, and HR systems simultaneously carry wide credential exposure surfaces, so freshly harvested employee credentials for systems such as OWA webmail and internal portals may provide a viable intrusion route consistent with the group’s established tradecraft. Given the active exposure windows, CTG should treat all 14 credential holders as fully compromised, force immediate password resets across the identified systems, and audit all privileged session activity. Phishing-resistant MFA on all remote access and internal platform entry points is the most urgent mitigation against credential-based intrusion. SOCRadar’s Attack Surface Management and Dark Web Monitoring modules provide ongoing credential exposure visibility, supporting continued monitoring for any additional records tied to the company’s domains.