Northern Leasing Systems Data Breach

Northern Leasing Systems, a Canadian provider of equipment leasing and point-of-sale financing services, was listed as an alleged victim on Qilin’s dark web portal on August 26, 2026. This listing was surfaced by SOCRadar’s Dark Web Monitoring service. As is common with ransomware group claims, this particular listing has not been independently confirmed as a data breach. The Qilin ransomware group has been actively targeting the financial services sector. In the 60 days preceding this listing, Qilin claimed 217 victims, with an increasing frequency of financial services firms appearing among them. Notable recent victims in this sector include STRUCTURED SETTLEMENT CAPITAL LLC (US), Consultores de Seguros, Philippe Hottinguer Finance (France), and Coface (Italy). While the group’s primary targets have traditionally been manufacturing, professional services, and technology, with a geographic focus on the US, Germany, and Italy, their growing interest in financial services firms across multiple continents warrants close attention. Northern Leasing’s business model, which involves equipment leasing and POS financing, likely means they hold substantial amounts of merchant and customer financial data, making them an attractive target.

SOCRadar’s stealer-log query for the domain northerndirect[.]com returned no records in the sampled data. This absence of records within this specific query does not confirm that the organization is unaffected by credential compromise. It indicates that no relevant records were surfaced in this particular paginated sample. Potential exposures may exist in other data feeds not included in this dataset, could be associated with alternate corporate domain variants, or might be linked to personal email aliases used by employees. The Qilin ransomware group typically gains initial access through credentials harvested by infostealers, which are then validated against platforms like Microsoft 365 or VPN portals. Therefore, continuous monitoring for credential exposure remains a critical security measure, even when initial queries for a specific domain do not yield direct results. Organizations should maintain vigilance and consider the possibility of credential compromise through various vectors. Continued dark web monitoring of northerndirect[.]com across additional telemetry feeds is recommended. Furthermore, it is crucial to enforce robust credential hygiene practices throughout the organization, including regular password rotations and multi-factor authentication reviews.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.