Prodiel Data Breach

qilin listed Prodiel, a Spanish Energy & Utilities company, on its leak site on October 12, 2026. SOCRadar identified 18 employee credentials for prodiel[.]com across multiple high-value access points, including the organization’s Microsoft 365 tenant, remote-access infrastructure, and ERP systems. Prodiel has not issued a public statement. The energy sector is a common target for ransomware groups due to its critical infrastructure nature and the potential for significant disruption. Prodiel is one of 216 organizations qilin has claimed in the past 60 days. The group’s campaign concentrates in Manufacturing, Technology, and Energy, with primary geographic targeting in the U.S., Spain, and the U.K. Spain ranks among the top three targeted countries, and Prodiel aligns with the group’s active geographic focus. Other victims claimed during the same period include ConAuto (Ecuador, Transportation), Astro Electroplating (U.S., Manufacturing), and Kyodo USA (U.S., Manufacturing).

The 18 credential records identified by SOCRadar span from mid-2026 to the date of the query and fall into several categories: 8 Microsoft 365 tenant credentials with @prodiel[.]com usernames, exposing Azure AD, organizational communications, and file-sharing platforms; 3 TeamViewer remote-access credentials, posing a direct lateral movement risk; 6 Sage ERP Single Sign-On (SSO) credentials, which manage financial and operational data; 1 internal password management portal credential; and 1 cPanel mail server credential. The TeamViewer and Sage ERP SSO credentials are of particular operational concern. Compromise of these credentials grants attackers direct, legitimate-looking access to financial systems and potentially remote control of endpoints without needing to breach the network perimeter. The freshness of these credentials indicates a recent potential compromise or exposure. Revoke active sessions and force password resets across all 18 identified credential accounts. The Sage ERP SSO endpoints and TeamViewer instances require immediate access-log review to determine whether active sessions occurred post-credential-harvest. Enforce phishing-resistant MFA across all remote-access and identity systems; the TeamViewer exposure in particular points to unprotected remote-access tooling reachable from outside the network perimeter.