ConAuto Data Breach

Stealer-log analysis for ConAuto (conauto[.]com[.]ec) revealed five employee credentials, with four directly targeting the organization’s Microsoft 365 tenant using @conauto[.]com[.]ec corporate usernames. The ransomware group qilin claimed responsibility for targeting the Ecuadorian automotive distributor on its leak site on October 12, 2026. This claim is part of a larger campaign by qilin that targeted 216 victims over a 60-day period. The compromised credentials span from July to October 2026, indicating their recent validity. ConAuto, as an automotive distributor, could be attractive to ransomware actors due to the critical nature of its supply chain and business operations. qilin’s recent campaign, involving 216 victims over 60 days, marks a period of significant activity for the group. Their typical targeting patterns focus on the Manufacturing, Technology, and Transportation industries, with a primary geographic focus on the United States, Spain, and the United Kingdom. Other organizations claimed during this recent period include Prodiel (Energy & Utilities, Spain), Astro Electroplating (Manufacturing, US), and Kyodo USA (Manufacturing, US). ConAuto’s inclusion in this campaign aligns with qilin’s established industry and geographic preferences.

The analysis of stealer-log data for ConAuto (conauto[.]com[.]ec) identified five compromised credentials. Four of these were directly associated with ConAuto’s Microsoft 365 tenant, utilizing the corporate domain @conauto[.]com[.]ec. Additionally, one record was found on Microsoft’s consumer identity platform, configured for organizational single sign-on (SSO). The observed credentials date from July through October 2026, indicating their recent compromise. The compromised credentials provide access to various platforms and systems. Four records pertain to the Microsoft 365 tenant, suggesting potential access to Azure AD, organizational SSO, and associated services like email, file-sharing, and business applications. Another credential relates to Microsoft’s consumer identity platform, also configured for organizational SSO. The analysis also indicated the presence of internal portal endpoints and an Odoo-based ERP instance within the compromised data sample. Furthermore, three additional credentials were found on third-party SaaS platforms. The exposure of Odoo ERP credentials is of particular concern, as it suggests a potential pathway into ConAuto’s core operational and financial data management systems. All five compromised credential sets require immediate invalidation. Active sessions within the Microsoft 365 tenant, particularly Azure AD session tokens from July through October 2026, should be revoked before forcing password resets. A review of access logs for the Odoo ERP and internal portal endpoints is recommended to identify any anomalous activity within the July–October 2026 timeframe. Implementing phishing-resistant multi-factor authentication (MFA) on all identity systems, especially the organizational SSO endpoint, is a critical remediation priority.