Grayson Rural Electric Cooperative Data Breach

Grayson Rural Electric Cooperative, a member-owned electric utility based in the United States, has been targeted by the Qilin ransomware group. The incident was identified on September 2, 2026, through SOCRadar’s dark web monitoring. The targeting of an electric cooperative suggests a potential interest in critical infrastructure, a sector Qilin has shown a willingness to exploit. In the preceding 60 days, Qilin claimed 243 victims, positioning itself as one of the most active groups during this period. The ransomware group primarily targets the Manufacturing, Professional Services, and Government & Defense sectors. The United States represents the largest portion of its victims, with 71 out of 243 recorded incidents. Other notable victim countries include Germany and Italy. Recent attacks by Qilin include Uak University (Turkey, Education), Commission de la construction du Québec (Canada, Government & Defense), Allied Recycling (Ireland, Manufacturing), and Inmac (Argentina, Retail & E-Commerce). Grayson Rural Electric Cooperative aligns with Qilin’s established pattern of targeting organizations within the United States and its inclination towards critical infrastructure.

SOCRadar’s query of the domain graysonrecc[.]com returned 25 records, all of which were identified as customer portal credentials. Further analysis revealed login endpoints at billing.graysonrecc[.]com, associated with customer portal logins and account creation. The observed usernames were primarily masked numeric IDs and generic handles consistent with consumer account identifiers. Importantly, no corporate email domains were detected within this specific sample of the stealer-log data. The retrieved credentials span from May 25 to September 1, 2026. The presence of recurring account identifiers across multiple timestamps suggests that these customer accounts have not been rotated. While this specific query did not identify employee credential exposure, it does not rule out the possibility that employee credentials may exist elsewhere within the complete stealer-log corpus, particularly in data feeds not covered by this particular search. The material risk of customer account takeovers (ATO) runs parallel to the ransomware incident. Both customer-facing and potentially employee credential feeds require active monitoring. The absence of employee records in this sampled data should not be interpreted as confirmation that no compromise has occurred. Continuous monitoring of the dark web and stealer-log feeds for any additional relevant data related to Grayson Rural Electric Cooperative is recommended. Organizations should also conduct proactive credential hygiene checks, including password rotation and multi-factor authentication reviews for all accounts.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.