DAB Investments Data Breach

Qilin ransomware has targeted DAB Investments, a financial services company based in the United Kingdom. The threat actor listed DAB Investments on its data leak site on August 27, 2026, an incident that was identified via SOCRadar’s Dark Web Monitoring service. This incident falls within a broader pattern of Qilin’s activity, which has demonstrated a consistent focus on the financial sector. Over the preceding 60 days, Qilin has claimed a significant number of victims, totaling 234. The group’s operational focus frequently includes investment management and financial advisory firms, with recent analogous listings including Bloom Financials, Providence Investments, Northern Leasing Systems, and STRUCTURED SETTLEMENT CAPITAL LLC. DAB Investments aligns with this targeting strategy, fitting the profile of Qilin’s typical victims operating within the US and UK financial landscape.

SOCRadar’s platform initiated a query against the domain dabinvestments[.]com. The query returned no associated records. It is important to note that a null result does not confirm the absence of compromise. This query covered a limited, paginated sample of data, and it is possible that credentials may exist under alternative corporate domains or utilize personal email aliases that were not included in this specific dataset. Therefore, this outcome should be interpreted as the absence of positive findings, not as conclusive evidence of the organization being unaffected. The presence of stealer-log data, even when not directly correlating to a specific organization, can provide valuable insights into the broader threat landscape and potential intrusion vectors. Infostealer malware is commonly used to harvest credentials from compromised systems, which can then be leveraged by ransomware operators. This harvested information might include login details for corporate accounts, VPNs, remote-access portals, or cloud services like Microsoft 365. Such credentials can facilitate initial access for threat actors, allowing them to move laterally within a network and deploy their ransomware payloads. Given that the query for dabinvestments[.]com yielded no direct telemetry, continued monitoring is advised. Organizations should consider implementing proactive measures such as regular credential hygiene checks, rotating passwords, and reviewing multi-factor authentication configurations. Monitoring of alternate corporate domains and associated services like Microsoft 365 and VPN access logs can also help detect potential unauthorized activity.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.