RaceTrakka Data Breach

Qilin listed RaceTrakka on its dark web portal on October 26, 2026, and the listing was identified through SOCRadar’s Dark Web Monitoring service. RaceTrakka is a retail and e-commerce company based in Australia. As with any leak-site listing, the claim has not been independently verified, so the incident should be treated as alleged until confirmed. Retail and e-commerce organizations are recurring targets for ransomware operations because they hold customer records, transaction data, and commercial systems whose disruption can carry direct financial and reputational impact. The listing sits within an exceptionally high-volume campaign. Qilin claimed 191 other victims in the prior 60 days — among the highest volumes of any active ransomware operator currently. Its primary targets cluster in Manufacturing, Technology, and Other sectors, with the United States, Spain, and United Kingdom absorbing the bulk of listings. Australia is secondary in its targeting profile. RaceTrakka joins recent retail and e-commerce co-victims The Frame Group, Five Star Sheets, Zachary Confections, and ECOM, which places the company alongside peers in the same sector. For Qilin, this listing fits a global campaign pattern rather than a specific Australian focus, and the victim’s retail profile is consistent with the group’s willingness to target a broad range of industries beyond its most frequent ones.

SOCRadar’s stealer-log query for racetrakka[.]com.au returned no records in this sample. The dataset is bounded and paginated, so the result reflects only the sample queried rather than an exhaustive sweep of available credential corpora. Credentials belonging to RaceTrakka employees or customers may exist under employee personal aliases, under adjacent infrastructure not covered by the query, or in feeds outside the queried dataset. Records may also have been used and rotated before being indexed, or may not yet have been indexed at all. A no-hit result is a neutral signal: no positive correlation was observed, but it is not an exoneration, and the absence of evidence does not rule out that compromise occurred. When stealer-log exposure is found for a company, harvested credentials can feed directly into ransomware operations. Credentials recovered from infostealer infections frequently provide access to corporate accounts, including Microsoft 365, VPNs, and remote-access portals, and can be validated by initial access brokers before being sold or handed to ransomware operators. In this case, however, the telemetry returned no records, and no positive access-path finding can be claimed for RaceTrakka. Any intrusion route the group may have used — including credential-based entry — remains a possibility rather than an established fact, and should be treated as an unconfirmed scenario. Given the leak-site listing and the limited visibility of the telemetry sample, continued dark web and stealer-log monitoring is warranted, along with proactive credential-hygiene checks and password rotation for corporate accounts, particularly where multi-factor authentication coverage is incomplete. Organizations should also monitor alternate corporate domains and review Microsoft 365, VPN, and remote-access activity for anomalous sign-ins that could indicate misuse of exposed credentials.