Incredible Technologies Data Breach

Incredible Technologies, a technology company based in the United States, has been identified as a victim by the Booba Project ransomware group. The listing occurred on July 28, 2026, and was detected by SOCRadar’s Dark Web Monitoring service. While the exact nature of the compromise remains under investigation, the technology sector, particularly companies operating in the U.S., can be attractive targets for ransomware groups due to the potential for significant financial gain and the criticality of their services. Booba Project appears to be a low-volume threat actor, claiming four other victims in the 60 days preceding this incident. Their targeting has primarily focused on the business services, technology, and manufacturing industries, with an overwhelming majority of their victims located in the United States, supplemented by a single confirmed victim from Russia. Incredible Technologies aligns with this observed pattern of targeting U.S. entities within high-value sectors. Previous victims linked to Booba Project include Oklahoma Manufacturing Alliance, Pelli Clarke Pelli Architects, Jani-King, and URA Group, indicating a consistent profile for their attacks.

Analysis of stealer-log data related to the incident revealed 25 records, all of which were consumer-facing and captured within the two weeks prior to the listing date. These credentials were found on the domain itsgames[.]com and were associated with external/consumer user accounts authenticating against the company’s infrastructure, rather than employee accounts. The compromised credentials point to customer-facing areas such as a password-reset endpoint, a customer login service, and an operator-registration page. This activity occurred within a concentrated timeframe, approximately from July 16 to July 28, 2026. Notably, no corporate-domain (@itsgames[.]com) usernames were identified, suggesting the focus was on customer account takeovers and supplier risk rather than direct workstation compromise within the corporate environment. While these findings do not directly link the captured credentials to the Booba Project group, infostealer logs are a known method of obtaining initial access for this ransomware variant. The presence of a significant volume of recently harvested user credentials on a victim’s infrastructure is consistent with the type of environment that often precedes such ransomware attacks. The primary exposure identified from these credentials is to customer account takeover and increased breach notification risks. The evidence does not conclusively tie these specific credentials to the group’s attack. However, given that infostealer logs are a known initial access vector for Booba Project, and the data points to customer service interfaces, the immediate concern is the potential for large-scale customer account compromise and subsequent data exfiltration or extortion. Continued dark web monitoring and vigilance regarding customer-facing services are recommended.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.