Mairie de Rinxent Data Breach

Mairie de Rinxent, a government and defense organization based in France, was listed on the Krybit ransomware group’s leak portal on August 2, 2026. This detection was made by SOCRadar’s Dark Web Monitoring service. The listing specifically places Mairie de Rinxent within the government and defense sector in France. This incident occurs amidst a period of moderate, consistent activity from the Krybit threat actor. In the 60 days preceding this listing, Krybit claimed an additional 29 victims. The group’s activity during this period was notably concentrated in the Technology, Financial Services, and Public Sector industries, with a significant focus on victims located in Mexico, South Africa, and India. Several organizations share commonalities with Mairie de Rinxent, including Nile Petroleum Corporation, CH. Karnchang Public Company Limited, LAXAI Life Sciences Pvt. Ltd., and Vibonum Technologies Private Limited, all of whom have been previously claimed by Krybit and operate within the government and defense sector or are based in France. However, neither France nor the government and defense sector are the primary targets for Krybit, suggesting the group may be opportunistically targeting a broader range of entities beyond their usual pattern.

SOCRadar’s correlation of initial access indicators with its stealer-log telemetry data yielded no records for the domain ville-rinxent[.]fr within the queried dataset. It is important to note that a null result from this specific query does not definitively confirm that the organization is unaffected by any compromise. The telemetry query samples a single dataset and focuses on the primary corporate domain, potentially missing credentials associated with alternate, legacy, or subdomain variations. Furthermore, credentials harvested under personal email aliases are not captured by this domain-centric search. Smaller organizations, in particular, are often underrepresented in commodity stealer feeds, which tend to prioritize high-traffic consumer services and their associated credentials. Groups like Krybit frequently leverage infostealer-harvested credentials as a primary method for initial access. Threat actors, or the access brokers from whom they acquire compromised credentials, typically source recent logs from underground marketplaces. These logs are then validated, and any working corporate credentials are used to gain access to systems such as Microsoft 365, VPNs, or remote-access portals. Following successful access, ransomware is then deployed. The absence of records in this particular query does not preclude this method of attack. It remains possible that credentials were exposed in other data feeds not included in this analysis, were used and subsequently rotated before being indexed, or were harvested using personal email addresses that would not be associated with the queried corporate domain. The assessment concludes that continued monitoring is advisable. Organizations should conduct proactive credential-hygiene checks, recognizing that a null query result does not serve as exoneration.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.