DROUIN SAS Data Breach

Booba Project added DROUIN SAS to its dark web portal on November 3, 2026, in a listing identified by SOCRadar’s Dark Web Monitoring service. DROUIN SAS is a French industrial manufacturer operating in heavy industry and mechanical engineering supply chains, with procurement and logistics integrations connecting it to major European manufacturing conglomerates. That profile matters because European manufacturers with dense supply-chain integrations give ransomware groups compounded leverage: compromising a supplier creates pressure on upstream partners as well. SOCRadar also notes that the associated credential data makes this listing particularly significant. Booba Project’s current campaign window covers France, the United States, Sweden, and the United Kingdom, and its concurrent victims span wholly unrelated sectors: DROUIN SAS (Manufacturing), the City of Edgewater (Government), Vetstoria (Healthcare), and Boardman Park (Services). The group’s willingness to pursue organizations across unrelated sectors and geographies in parallel points to broker-sourced access rather than targeted intrusion. DROUIN SAS fits this pattern of parallel, sector-diverse targeting, which means the listing reflects the group’s broad current campaign rather than a narrow or exceptional choice of victim.

SOCRadar’s stealer-log telemetry surfaced a severe exposure for the DROUIN SAS domain. Twelve records were found across two categories: direct employee credentials targeting the organization’s Microsoft Identity Provider infrastructure (category A), and corporate users accessing Liebherr Group’s supply-chain SaaS platform from DROUIN SAS workstations (category C). The freshness window runs from November 2025 through October 2026, an eleven-month span ending one month before the ransomware listing. No rotation is evident across the sample. The timing is the most concerning element: credentials harvested as recently as October 2026, including direct employee credentials against the organization’s Microsoft Identity Provider, may have remained valid when Booba Project named DROUIN SAS. While the leak-site listing does not document how the group obtained access, the mix of direct IdP credential exposure with supply-chain SaaS access from compromised endpoints is consistent with sustained post-intrusion credential harvesting. Left unrotated, such credentials could enable continued access to corporate identity and SaaS environments, and the category C records show that harvesting captured third-party platform sessions alongside internal identity data. The recommended response follows directly from these findings. Force immediate credential rotation for all accounts in the exposure sample. Audit Microsoft IdP sign-in logs for anomalous activity across the November 2025–October 2026 window. Notify the relevant Liebherr Group security team regarding the category C records, since credential reuse or session-token abuse across interconnected industrial platforms can extend the blast radius beyond DROUIN SAS itself. Together, these steps address both the internal identity exposure and the supply-chain dimension of the incident.