Infomedia A/S Data Breach

On October 5, 2026, the ransomware group aurora listed Infomedia A/S, a Danish provider of media monitoring and news analytics, as a victim. SOCRadar’s threat intelligence identified 14 compromised credential records associated with infomedia[.]dk, with a concentration of these records appearing between July and September 2026. This three-month window of credential compromise immediately preceding the listing suggests that the attack chain likely involved the exploitation of harvested application credentials. For a company whose business model fundamentally relies on data integrity and maintaining subscriber trust, this situation presents an elevated risk profile. In the preceding 60 days, aurora has claimed 16 victims, predominantly targeting the professional services, manufacturing, and retail sectors. Its primary victim countries include the United States, Germany, and Denmark. Recent organizations claimed by the group include Chip 1 Exchange, Thomas Y. Pickett & Co., Inc., and Laboratorios Roemmers SAICF. The inclusion of Denmark on aurora’s target list indicates the group’s ongoing expansion into European markets.

SOCRadar’s threat intelligence platform detected 14 compromised credential records linked to the domain infomedia[.]dk. These records span the period from July to September 2026. The types of compromised credentials include one corporate credential log, ten business application credentials, two workstation compromise artifacts, and one URL-based credential. The presence of ten business application credentials is a significant indicator. These credentials likely grant authenticated access to various Software-as-a-Service (SaaS) platforms, content management systems, and media aggregation tools that are critical to the operations of a media monitoring company. When threat actors possess such credentials, they may be able to move laterally across systems, potentially accessing subscriber management systems or content delivery APIs without necessarily triggering conventional perimeter security alerts. This method represents a less conspicuous entry path compared to brute-forcing VPNs, and can be highly effective for attackers. Infomedia’s response should prioritize the immediate revocation of all active application sessions and a comprehensive rotation of platform credentials. Furthermore, anomaly-based monitoring should be implemented across all authenticated services. Subscriber data and content delivery records should be treated as potentially compromised until forensic analysis can confirm their integrity. Given Infomedia’s role in aggregating sensitive media content for corporate and institutional clients across Scandinavia, there may be downstream notification obligations for the company to consider.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.