Solid Trading Data Breach

On October 18, 2026, a ransomware group claimed to have compromised Solid Trading, an international trading company. The threat actor stated that corporate data was exfiltrated and threatened to release this data publicly. Commercial trading firms are often targeted due to the high value of their data, which includes financial transaction records, counterparty contracts, and trade agreements. This data is sensitive and can significantly increase the pressure on a victim to pay a ransom. Ransomware operators have been observed expanding their targeting scope to include the trading and commodities sectors across various regions, including Europe, Asia, and North America. The inherent regulatory and competitive sensitivity surrounding trade data further amplifies the leverage ransomware groups can exert. This broadened targeting pattern suggests a strategic shift by some threat actors to exploit the unique vulnerabilities and data types found within financial trading operations.

A SOCRadar stealer-log query performed for Solid Trading’s associated domains did not yield any matching records. Analysis of the queried infostealer telemetry did not identify any employee or customer credentials. However, the absence of stealer-log data does not definitively rule out a compromise. Prior credential exposure could have occurred through various methods such as phishing attacks, business email compromise (BEC), or the exploitation of vulnerabilities within trading platforms, with the data subsequently being used or rotated before it was indexed. The presence of sensitive financial and trade data within a company like Solid Trading makes it a potentially attractive target for ransomware operations. While no direct evidence of credential compromise was found in the analyzed stealer-log data, the possibility of unauthorized access cannot be dismissed. Such access, if gained through compromised credentials or other means, could facilitate data exfiltration and subsequent ransomware deployment. Recommended Actions Enforce Multi-Factor Authentication (MFA) across all trading platforms and email accounts. Implement robust access controls for all financial systems. Continuously monitor for anomalous authentication patterns and unusual data movement within the network.