fessport Data Breach

ZaWoo listed fessport[.]de on its leak site on August 30, 2026, claiming unauthorized access to the German professional services firm’s systems and data. While no independent verification of the breach has been completed, the listing by ZaWoo signals a potential compromise. fessport, operating within the professional services sector in Germany, is a plausible target for ransomware operations, given the industry’s reliance on sensitive client data and complex digital infrastructure. ZaWoo has demonstrated significant activity in recent months, claiming 16 victims over the past 60 days. The group’s primary targets are located in Germany, Austria, and Canada, with a particular focus on the Technology, Manufacturing, and Professional Services sectors. fessport’s profile as a professional services firm in Germany aligns directly with ZaWoo’s established targeting patterns, suggesting a deliberate choice of victim.

No credential records tied to fessport[.]de were found in current infostealer datasets. This null result does not definitively clear the ZaWoo claim. It is possible that the credentials were not indexed, have been rotated since the compromise, or that alternative corporate domains were utilized. Phishing campaigns or the exploitation of publicly-facing services remain plausible initial-access vectors for ransomware groups like ZaWoo, even in the absence of direct stealer-log correlation. The investigation into ZaWoo’s activities and potential victimology is ongoing. Continued monitoring of dark web and stealer-log datasets for fessport[.]de and related domains is recommended. Organizations are also advised to conduct proactive credential hygiene checks, review multi-factor authentication configurations, and monitor remote access and cloud service logs for suspicious activity.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.