RaceTrakka Data Breach

Qilin listed RaceTrakka on its dark web portal on October 26, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. RaceTrakka is a retail and e-commerce company based in Australia, making it part of a consumer-facing sector whose customer data, order records, and online sales platforms can be attractive targets for extortion and data-leak operations. The claim appeared on Qilin’s leak site, and the listing should be treated as an alleged incident until independently confirmed or acknowledged by the company. The listing fits Qilin’s exceptionally high-volume campaign. In the prior 60 days, Qilin claimed 191 other victims — among the highest volumes of any active ransomware operator currently. Its primary targets cluster in Manufacturing, Technology, and Other sectors, with the United States, Spain, and the United Kingdom absorbing the bulk of listings. Australia remains secondary for the group, though RaceTrakka joins recent retail and e-commerce co-victims including The Frame Group, Five Star Sheets, Zachary Confections, and ECOM. This indicates meaningful overlap with other retail and e-commerce victims in the group’s recent victim pool, but for Qilin the RaceTrakka listing fits a global campaign pattern rather than a specific Australian focus.

SOCRadar’s stealer-log query for racetrakka[.]com.au returned no records in this sample. The dataset used for the query is bounded and paginated, meaning the result reflects only a limited sample of available telemetry. Credentials may exist under employee personal aliases or adjacent infrastructure not covered in this query, and records could also reside in feeds outside the dataset that was searched. As a result, this finding should be treated as no positive signal, not an exoneration — the absence of stealer-log records for the queried domain does not confirm that RaceTrakka is unaffected or that no compromise occurred. When infostealer-harvested credentials are present in underground datasets, they can support ransomware operations by giving initial access brokers or ransomware operators a pathway into corporate environments, potentially through corporate accounts, remote-access portals, or similar services once credentials are validated for reuse. In this case, no such records were found in the queried sample, so no direct correlation between stolen credentials and the Qilin listing could be established. The Qilin claim itself remains the primary observed signal, and any intrusion path remains speculative absent confirmed telemetry. RaceTrakka should continue dark web and stealer-log monitoring, including monitoring alternate corporate domains and employee personal aliases, and perform proactive credential-hygiene checks to ensure credentials that may appear in other datasets or adjacent infrastructure are addressed.