DATEM, Inc. Data Breach

DATEM, Inc., a Philippines-based technology and information services company operating through datem[.]com[.]ph, was listed on Crypto24’s dark-web leak portal on October 27, 2026. SOCRadar identified the listing through its Dark Web Monitoring services. As with all leak-site entries, the claim is treated as an alleged breach pending independent verification. The disclosure forms part of a regional targeting push by Crypto24, an emerging ransomware actor whose recent activity has concentrated on Southeast Asian organizations, making DATEM’s sector and geography consistent with the group’s current operational focus. The listing falls within a 60-day window in which Crypto24 has claimed three victims, with activity concentrated in the Technology and Healthcare sectors and in the Philippines, Malaysia, and Singapore. The October 27 disclosure was one of two coordinated Southeast Asian listings made by the group that day, alongside Antah HealthCare Group, a Malaysian healthcare organization, and represents a significant escalation for an actor with a small prior footprint. DATEM therefore sits squarely within Crypto24’s emerging pattern of ASEAN technology and healthcare targeting. Pattern inference remains limited by the small sample size, but the group’s geographic concentration on ASEAN technology and healthcare organizations warrants close monitoring.

SOCRadar’s stealer-log telemetry for datem[.]com[.]ph returned 25 records, of which 16 were classified INTERNAL_AUTH_EMPLOYEE (category A) — multiple DATEM corporate credentials spanning identity/SSO infrastructure and mail systems. Log dates run from April through October 2026, and the most recent insert dates fall in October 2026, indicating active harvesting in the period immediately preceding the ransomware listing. The sustained exposure window of more than six months (April–October) points to either repeated stealer-log infections within DATEM’s environment or prolonged persistence of the harvested credentials in underground markets. The concentration of category-A records on identity and mail systems means the organization’s authentication and communications backbone is directly implicated by the exposed data. The combination of 16 category-A records on identity and mail infrastructure, together with fresh October 2026 insert dates, is consistent with the pre-compromise reconnaissance phase typical of ransomware operations. Concurrent fresh credential harvesting and a same-month ransomware listing constitute a high-confidence indicator of credential-facilitated initial access. Volume, recency, and infrastructure specificity — SSO/IdP and mail systems — all point toward the same conclusion: these credentials were likely the attack pathway. While the telemetry confirms credential exposure rather than a documented intrusion, the timing and infrastructure overlap make a credential-based intrusion route the leading scenario in this case. For DATEM, and for technology companies across Southeast Asia facing concurrent stealer-log exposure on identity infrastructure alongside a ransomware listing, this combination warrants immediate incident response. Credential rotation, access log review, and identity provider (IdP) anomaly detection should be treated as first priorities, given the concentration of exposed records on the identity and mail infrastructure at the center of this case.