Morgan Services Data Breach

Morgan Services, a professional services organization based in the United Kingdom, has been targeted by the AiLock ransomware group. The listing of Morgan Services as a victim was identified on August 26, 2026, through SOCRadar’s Dark Web Monitoring. As a company operating in the professional services sector, Morgan Services may be an attractive target for ransomware operations due to the potential for high-value data related to its clients and business operations. AiLock has been active in recent months, listing seven other victims in the 60 days preceding this incident. The ransomware group primarily targets the Other, Professional Services, and Technology sectors, with a significant number of victims in the United States and Japan, and increasingly in the United Kingdom. Recent victims include WBF Construction, Richmont Graduate University, DAISEN, and Pinturas Prisa. The targeting of Morgan Services marks AiLock’s second UK victim in this campaign window, indicating the group’s willingness to expand its reach into English-speaking markets beyond North America.

SOCRadar’s analysis of stealer-log data for the domain morganservices[.]com returned no immediate records. It is crucial to note that this result represents a partial view, as the query covered only a paginated and indexed sample of available logs. Therefore, the absence of records does not definitively confirm that the organization is unaffected. The potential for credential exposure remains significant. Data might exist under alternate or subdomain variations of the corporate domain, within other data feeds not included in this specific query, or through the use of personal email aliases associated with corporate accounts. AiLock is known to leverage credentials harvested from stealer-logs as an initial access vector for their ransomware operations. Consequently, the current lack of visible records does not rule out the possibility of compromised credentials or an ongoing intrusion. Action: Monitor morganservices[.]com across additional feeds. Apply credential hygiene proactively.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.