Delta Marine Data Breach

Qilin added Delta Marine to its dark web leak site on October 6, 2026. Delta Marine is a Finland-based transportation company operating at deltamarine[.]com. The listing was identified through SOCRadar’s Dark Web Monitoring service. In the 60 days preceding this listing, Qilin claimed 216 other victims, with a consistent focus on the Manufacturing and Technology sectors. The United States, Germany, and the United Kingdom represent the most frequent geographic targets, though the group’s operations extend across Europe. Transportation and logistics operators are regularly targeted, including recent victims such as Tramigo, Thai Lion Air, Touring Club Suisse, and RoadEx America. Delta Marine’s inclusion extends this pattern to Nordic targets, a region that has historically seen fewer Qilin victimizations compared to Western Europe.

SOCRadar’s telemetry returned one credential record for deltamarine[.]com. This record, categorized as C, involves a corporate-domain credential exfiltrated alongside a third-party URL on December 9, 2025. This profile suggests an infected endpoint rather than direct access to VPN or identity infrastructure. While a single record provides limited signal, it’s important to note that the absence of VPN portal, identity provider, or corporate email endpoint data in this specific sample does not preclude their existence in the broader stealer-log corpus. The record from December 9 should be treated as an indicator of workstation compromise. It is recommended to reset the associated credential and extend monitoring to additional stealer-log feeds. For Qilin, the acquisition of infostealer credentials is a standard initial access vector. They source logs from underground markets, validate them against VPN portals or Microsoft 365 tenants, and then distribute them to affiliates. The stealer-log data observed in this instance does not confirm that these specific credentials were utilized by Qilin to access Delta Marine’s network.