McKenneys Data Breach

IAH6477 added McKenneys to its data leak site on October 18, 2026. McKenneys is an Atlanta, Georgia-based mechanical contractor that provides HVAC, plumbing, electrical, and building systems services to commercial, industrial, and institutional clients. The company is now listed as a victim in the Professional Services sector, with an exfiltration-backed extortion threat. IAH6477 has claimed approximately 16 victims over the past 60 days, primarily in the US and UK. The group’s typical targets include the Manufacturing, Professional Services, and Agriculture industries. Previous victims include Hilmar Cheese Company, Camden Living, and Buckle, suggesting a pattern of targeting mid-market US companies across various sectors. The inclusion of McKenneys, an engineering and facility services firm, represents a notable expansion of IAH6477’s targeting into a vertical not previously prominent in their campaigns.

SOCRadar’s stealer-log intelligence identified credentials linked to McKenneys’ corporate domain within analyzed infostealer samples, classifying this as Category A, severe exposure. These credentials appear to be for internal systems, suggesting that infostealer malware was active within McKenneys’ environment either preceding or concurrent with the ransomware incident. This type of credential exposure is significant because ransomware groups like IAH6477 often leverage stolen credentials to authenticate directly to corporate VPNs, RDP interfaces, or web portals without needing to exploit vulnerabilities. For a company like McKenneys, which manages sensitive data such as project details, client contracts, and proprietary building specifications, this presents a direct pathway for threat actors to access critical information. Given the findings, it is recommended that McKenneys immediately rotate any potentially compromised credentials, enforce multi-factor authentication on all remote access solutions, and conduct a thorough audit of third-party access privileges. Continued dark web and stealer-log monitoring is also advised to detect any further exposure or activity related to the organization.