Phithan Phanich Data Breach

Phithan Phanich, a manufacturing organization based in Thailand, has been listed as a victim on the qilin ransomware group’s dark web portal, published on August 9, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. Based on the sector and country data captured for the listing, the organization operates in the manufacturing space in Thailand. It joins a run of recent qilin listings that CTI teams have been tracking across the group’s leak portal. In the 60 days prior to this listing, qilin has claimed 146 other victims across its leak portal. The group has shown a strong targeting pattern in the Manufacturing, Business Services, and Professional Services sectors. Geographically, its victims cluster in the United States, Germany, and France. Other recent qilin listings that overlap with Phithan Phanich’s profile include Grupo Diestra, Harplast SRL, Service d’usinage 9002, and Clausing. Phithan Phanich fits the broader pattern of mid-market organizations appearing on this portal rather than standing out as an outlier.

Initial-access correlation against SOCRadar’s stealer-log telemetry surfaced a severe exposure for the phithan-usedcar.com domain. The queried slice returned nine records, all matching the company’s own domain, with six featuring masked usernames consistent with administrative accounts against the site’s root and authentication endpoints. Administrative credential exposure against the target’s own infrastructure sits at the corporate-intrusion end of the spectrum; the sample spans logs from late 2024 through 2026, indicating a persistent rather than one-off exposure. As a matter of policy, we do not publish the masked usernames, partial passwords, or raw URLs contained in the underlying records; the picture above is paraphrased from SOCRadar’s automated stealer-to-ransom analysis. For ransomware groups such as qilin, infostealer-harvested credentials are a well-documented initial access vector: operators or initial access brokers source fresh logs from underground marketplaces, validate the corporate credentials, and use them to log into Microsoft 365, VPN, or remote-access portals before deploying ransomware. While the stealer-log evidence here does not confirm that these specific credentials were used by qilin, the pattern is consistent with the kill chain typically observed for this class of incident. Therefore, credential rotation and session-token invalidation are sensible first moves for any responder working this case.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.