DC Partner (Pty) Ltd Data Breach

Krybit ransomware has claimed DC Partner (Pty) Ltd as a victim, with the listing appearing on the threat actor’s dark web portal on August 2, 2026, as observed by SOCRadar’s Dark Web Monitoring service. DC Partner (Pty) Ltd operates within the professional services sector and is based in South Africa. The Krybit threat actor exhibits a moderate and steady operational cadence. The targeting of professional services firms and entities in South Africa by Krybit aligns with their recent operational focus, potentially making such organizations attractive targets due to the sensitive nature of their data and operations. Over the preceding 60 days, Krybit claimed 29 other victims. The ransomware group frequently targets the Technology, Financial Services, and Public Sector industries. Major geographic concentrations for Krybit’s victims include Mexico, South Africa, and India. Several organizations with overlapping characteristics, such as being in the professional services sector or operating from South Africa, have also been listed, including Nile Petroleum Corporation, CH. Karnchang Public Company Limited, LAXAI Life Sciences Pvt. Ltd., and Vibonum Technologies Private Limited. While the current victim’s geographic location aligns with the group’s established footprint, the targeting of the professional services sector represents a slightly broader pattern, which is notable for organizations assessing their sector-specific exposure to this actor.

SOCRadar’s investigation into potential initial access vectors for DC Partner (Pty) Ltd revealed a significant exposure on the domain dcpartner.co[.]za. The query returned six records, all associated with corporate credentials for the email domain @dcpartner.co[.]za. These credentials were categorized as corporate accounts on third-party services rather than direct logins to the company’s internal systems. The consistent usernames across these records suggest that one or two compromised endpoints, rather than a widespread credential harvesting operation, were the source of the exposure. Notably, two categories of endpoints were identified: a South African government business portal, where compromised credentials could potentially be used for fraudulent filings, and a financial and accounting service. The telemetry data indicates a dominant risk profile related to workstation compromise. The logged credentials span an eight-month period, from June 8, 2025, to March 10, 2026. While this evidence does not definitively confirm that Krybit utilized these specific credentials to gain access, it establishes that a credential exposure existed, was indexed, and the pattern aligns with the typical initial access kill chain employed by ransomware groups like Krybit. It is crucial for organizations to rotate credentials associated with this domain and to audit the affected endpoints for any signs of compromise, irrespective of whether a direct link to the Krybit incident is ever proven.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.