ECOM Data Breach

ECOM, a Swiss retail and e-commerce operator serving the European market, has been listed as a victim on the dark web leak portal of the Qilin ransomware group. The listing was published on October 25, 2026 and referenced the company’s domain, ecomgroup[.]com. SOCRadar identified the entry through its Dark Web Monitoring service. As a European commercial operation, ECOM sits in a sector where ransom negotiations typically revolve around high-value business data: customer data, payment records, and supply-chain information are likely in scope for any ransom negotiation stemming from this claim. Qilin is one of the most active ransomware operators globally at present. Over the past 60 days, the group has claimed victims across Technology, Healthcare, Retail & E-Commerce, and Manufacturing, with organizations in the United States, United Kingdom, Germany, France, and Switzerland among those targeted. Other recent Qilin listings include retail and e-commerce firms in the UK and France, meaning ECOM’s European commercial footprint places it squarely within the group’s established targeting range in both geography and sector. For Swiss organizations, the case is a reminder that Qilin’s European targeting is not confined to larger economies.

SOCRadar’s stealer-log telemetry query for ecomgroup[.]com returned no records in the sample examined. The dataset queried is a paginated slice of available stealer-log data rather than the full corpus, and that limitation matters for interpretation: credentials associated with ECOM could still exist under a staff member’s personal email alias or under a regional subdomain, outside the portion of the dataset covered by the check. A null result of this kind should be treated as a data gap, not an all-clear. The absence of records in this sample does not confirm that the organization is unaffected, since matching credentials may simply sit outside the queried slice or under domain variants that were not searched. The observable evidence at this stage consists of Qilin’s leak-site claim itself rather than any confirmed publication of ECOM data. Against that background, defenders should monitor the Qilin portal for a data release and verify whether company data has surfaced, rather than waiting for official confirmation before acting. Continued dark web and stealer-log monitoring is the practical follow-up, including repeat queries for credentials tied to alternate corporate domains, staff personal aliases, and regional subdomains that fell outside the initial sampled check. Reading the null stealer-log result as a limitation rather than an assurance, while tracking the group’s portal for posted material, offers earlier and more actionable signals than passively waiting for the breach status to be independently confirmed.