Durga Bearings Data Breach

Orova claimed Durga Bearings, an India-based manufacturer, on its leak site on October 13, 2026. This claim marks Durga Bearings as Orova’s second victim within the reporting cycle. Notably, a stealer-log query associated with Durga Bearings returned relevant findings, differentiating this incident from others where such data was absent. The manufacturing sector, particularly in India, is increasingly targeted by ransomware groups due to the sector’s digitization efforts and, in some cases, legacy IT environments that may lack modern security measures. Orova has been actively targeting organizations in Asia, the Middle East, and Europe throughout 2026. The ransomware group shows a consistent pattern of victimizing manufacturing and industrial organizations. The increased visibility of Indian industrial component manufacturers as targets aligns with broader trends in the sector’s adoption of digital technologies. These factors likely contribute to why companies like Durga Bearings may be attractive targets for ransomware and extortion activities.

SOCRadar identified durgabrgs[.]com in sampled stealer-log data prior to Orova’s claim. The queried data contained records predominantly targeting Durga Bearings’ corporate infrastructure, specifically associated with durgabrgs[.]com. The majority of these records were classified as employee credentials on organizational systems, rather than customer-facing accounts, representing the highest risk category for corporate network compromise. The presence of harvested employee credentials from stealer-logs is significant because it provides direct authenticated access to internal systems if these credentials are not rotated. Infostealers often capture credentials from user workstations or browsers, and these credentials can be sold on underground markets. If organizations are unaware of such data exfiltration and do not rotate compromised credentials, they become vulnerable to exploitation by threat actors who acquire this information. While the specific attribution of these logs to Orova’s initial access is unconfirmed, the prevalence of such employee credentials in underground markets at the time of the incident suggests that infostealer-enabled initial access is a plausible pathway for this attack. Recommendations for Durga Bearings include the immediate rotation of all employee credentials, a thorough forensic review of authentication logs to identify any unauthorized access patterns, and an assessment of whether any operational technology (OT)-adjacent systems may have been compromised. Broader recommendations for organizations in the manufacturing sector, especially in Asia, include the deployment of endpoint detection and response (EDR) solutions, implementation of multi-factor authentication (MFA) for all remote access, and segregation of offline backups to enhance resilience against ransomware attacks. Continuous monitoring of dark web markets for exposed credentials and ongoing credential hygiene checks are also crucial.