National Association of Credit Management Data Breach

The National Association of Credit Management (NACM), a US-based membership organization for credit and finance professionals, was added to the leak site of the ransomware group Krybit on October 29, 2026. NACM operates nacm[.]org and provides credit reporting, professional education, networking, and policy advocacy for the trade credit and commercial finance sectors. SOCRadar observed the listing on Krybit’s leak site, and the claim coincides with documented credential exposure affecting the organization’s member portal. Associations of this type hold member contact data and provide access to credit reporting and benchmarking resources, which can make their portals attractive to threat actors seeking authenticated access and downstream leverage. Krybit has claimed 50 victims over the past 60 days, with activity concentrated in India, Mexico, and the United States. The group’s targeting is cross-sector, spanning Technology, Manufacturing, Professional Services, and financial services, and is broadly opportunistic. NACM fits this pattern: as a US-based organization serving the trade credit and commercial finance community, it falls within both the geographic and sector profile Krybit has been listing. The inclusion of a membership body whose credentials serve credit professionals is consistent with the group’s recent victims in professional services and financial services, rather than representing a departure from its typical targeting.

SOCRadar’s stealer-log telemetry identified 25 infostealer-log records tied to nacm[.]org, spanning May through October 2026. Every record is associated with my.nacm[.]org, the organization’s member portal. The records cover a six-month period, with activity running through October, within days of the Krybit listing, indicating continuous rather than one-time availability. This sustained presence in underground markets means adversaries had months of potential authenticated access to member portal accounts before the listing was published. The telemetry documents credential exposure on the portal domain; it does not by itself establish how Krybit obtained any data it may hold or whether the exposed accounts were actually used in an intrusion. Member portal credentials for a trade credit association carry downstream risk beyond the primary organization. Credit professionals use nacm[.]org to access credit reporting tools, benchmarking resources, and member contact data, meaning compromised accounts could expose material belonging to the association’s broader membership rather than NACM alone. Six months of active stealer-log exposure suggests deliberate targeting rather than a chance grab. The timing also matters: with records running through October, within days of the listing, the credential exposure may be connected to the Krybit claim, although the telemetry alone does not confirm the acquisition path or that these accounts were used in the intrusion. Given the sustained exposure, continued monitoring of dark web and stealer-log sources for nacm[.]org records is warranted, along with proactive credential-hygiene checks and password rotation for my.nacm[.]org accounts. A review of multi-factor authentication coverage on the member portal, together with monitoring of portal and remote-access sign-in activity for anomalous access, would help determine whether exposed credentials have been exercised. Member-facing account owners should be treated as potentially affected until their credentials are validated as current.