Jerry Leigh Data Breach

Jerry Leigh, a United States-based organization operating its own procurement and sourcing infrastructure, has been listed as a victim on the Lynx ransomware group’s dark web portal. The listing, identified by SOCRadar’s Dark Web Monitoring service on August 6, 2026, indicates a potential supply-chain-heavy business model with partner-facing systems. Jerry Leigh is one of two entries published by Lynx on this date. In the 60 days preceding this listing, Lynx had claimed two other victims. The group has primarily targeted organizations in the ‘other’ and business services sectors, with victims spread across the United Kingdom and the United States. Recent victims that share similarities with Jerry Leigh’s profile include Talbot County Department of Emergency Services and CommonWealth Partners. Jerry Leigh’s distinctiveness among these listings lies in the scale and complexity of its externally accessible digital footprint.

SOCRadar’s analysis of jerryleigh.com domain against its stealer-log telemetry revealed a significant exposure of corporate credentials. The queried data indicated three corporate credentials linked to identity and organization-owned infrastructure, twelve external usernames on the company’s supplier-facing subdomains, and one corporate identity found on a third-party service. Key high-value endpoints identified include the Microsoft 365 tenant identity provider, a cloud-hosted internal application, and the procurement subdomain, where a total of four distinct accounts appeared over a two-month period. The recurrence of one corporate identity across multiple services and dates suggests either unrotated credentials or repeated compromise of the same endpoint. The detected records span from May 27, 2026, to August 3, 2026, exhibiting long-tail persistence with a mixed profile. For ransomware groups like Lynx, credentials harvested by infostealers are a frequently observed vector for initial access. Threat actors or initial access brokers typically acquire these logs from underground marketplaces, validate the corporate credentials, and then use them to gain access to systems such as Microsoft 365, VPNs, or remote-access portals, preceding the deployment of ransomware. Although the current stealer-log evidence does not definitively confirm that these specific credentials were exploited by Lynx, the observed access to identity providers coupled with multiple accounts on a partner-facing supply-chain system aligns with common precursors to hands-on intrusion activity. CTI teams are advised to prioritize credential rotation for both employee and supplier accounts to mitigate potential risks, rather than awaiting direct confirmation of an attack. Continued dark web and stealer-log monitoring, proactive credential hygiene checks, and thorough review of password rotation and multi-factor authentication policies are recommended. Monitoring of alternate corporate domains, Microsoft 365, VPN, and remote-access activity should also be maintained.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.