Inova Semiconductors GmbH Data Breach

Qilin ransomware has claimed Inova Semiconductors GmbH, a German company specializing in automotive-grade integrated circuits, listing it on its dark web leak site on October 2, 2026. The ransomware group alleges data exfiltration from the company. Inova’s focus on semiconductor technology, particularly for the automotive sector, makes it a potential target for ransomware actors who may seek intellectual property or leverage supply chain disruptions. Over the past 60 days, Qilin has been particularly active in targeting technology and automotive supply chain firms within Europe. The group is known for conducting extensive reconnaissance before encryption, aiming to identify and exfiltrate high-value data assets. This incident with Inova Semiconductors aligns with Qilin’s typical targeting patterns, which often involve European technology and automotive sectors.

SOCRadar’s threat intelligence identified 16 credential records associated with Inova Semiconductors’ product registration portal (inova-semiconductors[.]de/registration). These records were found within stealer logs and spanned a seven-month period, from December 2025 to July 2026. Notably, among these findings were credentials for a supplier account from Technica Engineering (mar****s@technica-engineering[.]de) and an account believed to belong to a Panasonic employee. Both Technica Engineering and Panasonic are active participants in the automotive electronics supply chain, indicating that the exposure of partner credentials potentially expands the attack surface beyond Inova to its wider network of suppliers. The presence of these credentials on underground markets suggests a potential avenue for further compromise or lateral movement within Inova’s systems and those of its partners. The prolonged exposure window and the inclusion of third-party credentials highlight the critical importance of supply chain security. This incident underscores how vulnerabilities in one organization’s partner-facing portals can directly impact their business partners and extend the scope of a potential data breach. The sustained seven-month exposure period, coupled with the discovery of supply chain partner credentials within stealer logs, points to a prolonged and potentially undetected infostealer campaign targeting Inova’s registration portal. Given Qilin’s established interest in European semiconductor intellectual property, this listing is particularly relevant for any organization that has technical integrations with Inova Semiconductors. Next Steps: Inova Semiconductors GmbH should immediately notify Technica Engineering and Panasonic about the potential credential compromise. The company is advised to force a reset of all portal accounts and conduct a thorough audit of access logs for the period between December 2025 and July 2026. Engaging with the German Federal Office for Information Security (BSI) is recommended, along with an assessment for GDPR notification requirements based on applicable data protection obligations.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.