Dotlines Data Breach

Dotlines, a Singapore-headquartered managed services provider (MSP) operating across Southeast Asia, was listed on the Qilin ransomware group’s dark web portal on August 27, 2026. SOCRadar identified this listing through its Dark Web Monitoring service. Dotlines specializes in providing cloud, IT services, and enterprise application solutions to both enterprise and government clients, making it a potential target for ransomware operations due to its access to sensitive data and critical infrastructure. Qilin has been actively targeting organizations, claiming 68 victims in the past 60 days, with a focus on the technology, retail, and financial services sectors. Recent victims in the technology sector include Displaydata, Difor, Provite, and InVentry. Dotlines represents the group’s presence in the APAC region, aligning with their broad targeting strategy across various industries and geographies.

SOCRadar’s stealer-log telemetry detected 18 employee credentials associated with the domain dotlines[.]com[.]sg. These credentials provided access to administrative endpoints, including HRM portals, internal referral systems, operational consoles, and administrative panels within subdomains of dotlines[.]com[.]sg. The records were collected between August 3 and August 27, 2026, with the most recent data timestamped on the same day as the Qilin listing. The proximity of the credential harvesting timeframe to the Qilin listing suggests a rapid credential weaponization process. The harvested logs, particularly those targeting administrative functions, were likely validated and utilized by threat actors to deploy ransomware shortly after acquisition. This pattern is consistent with how infostealer-harvested credentials can facilitate swift ransomware operations, potentially bypassing traditional security measures if not promptly addressed. Dotlines, as an MSP, provides privileged administrative access to client environments. This means the scope of the investigation should extend beyond Dotlines’ own systems to include the connected client environments that are accessible through the company’s remote management infrastructure. The exposure of administrative credentials poses a significant risk not only to Dotlines but also to its downstream clients. Continued monitoring of dark web stealer-log feeds for any additional Dotlines credentials or related infrastructure is recommended. Organizations should also conduct proactive credential hygiene checks, ensure robust multi-factor authentication is implemented across all access points, and review logs for any suspicious activity related to Microsoft 365, VPNs, and remote-access portals.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.