ManagementPro Data Breach

ManagementPro, a professional services company that utilizes the domain mproerp[.]com, was listed on the Arcusmedia ransomware group’s leak site on August 24, 2026. The company’s domain suggests it offers enterprise resource planning or business management software solutions. Arcusmedia’s targeting of ManagementPro aligns with its ongoing pattern of exclusively targeting professional services and software companies, a sector that has consistently featured in the group’s known campaign activities. Over the 60 days preceding this listing, Arcusmedia claimed four victims, with a primary focus on technology and professional services organizations located in Brazil and Morocco. Despite a relatively low number of claimed victims, the group has demonstrated a consistent interest in providers of ERP, management consulting, and technology services. Notable previous victims of Arcusmedia include Mark’Techno, Power Moendas, and Brazer Ingenierie, indicating a pattern of targeting similar entities.

SOCRadar’s stealer-log telemetry analysis returned no records associated with the domain mproerp[.]com within the queried dataset. It is important to note that this dataset represents a paginated sample and may not encompass all active log feeds, alternate corporate domains, or credentials harvested using personal email aliases. Furthermore, ManagementPro’s undisclosed geographic location complicates the assessment of potential regional coverage gaps within the stealer-log telemetry. The methodology employed by Arcusmedia involves acquiring infostealer logs from underground marketplaces. These validated corporate credentials are then used to authenticate against platforms such as Microsoft 365, VPNs, or remote-access portals, serving as potential initial access points for ransomware deployment. For a provider of ERP or business management software, the attack surface can be extensive. Any customer-facing portal or administrative interface accessible via credential authentication poses a potential entry vector. Additionally, the deployment of ERP software by ManagementPro to its clients might create lateral access paths that could extend beyond the vendor’s own network infrastructure.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.