Roadvision Systems Data Breach

Roadvision Systems, a Swedish company specializing in road and traffic management technology, was identified as a victim of the TheGentlemen ransomware group on August 19, 2026. The discovery was made through SOCRadar’s Dark Web Monitoring. This incident is compounded by the exposure of 13 customer credentials across four Roadvision-operated subdomains, indicating a prolonged period of unrotated exposure spanning nearly two and a half years. The nature of Roadvision Systems’ business, providing critical infrastructure management, potentially makes it an attractive target for ransomware operations seeking to disrupt services or extort payment. TheGentlemen’s activity around August 19, 2026, involved claims against five organizations across different countries, including Babcock (South Africa, Defense), Senvest Capital (Canada, Financial Services), CRASL (UK), and Euroscreen (Italy, Technology). This broad geographic and industrial spread suggests the group’s targeting strategy is opportunistic rather than sector-specific, with a focus on acquiring access through various means. The presence of infrastructure-adjacent technology firms among their claimed victims indicates a pattern of exploiting companies that manage essential services or data.

SOCRadar’s Dark Web Monitoring identified 13 customer-tier credentials that authenticate against Roadvision’s subdomains: nwkdweb.roadvision[.]com, fcidweb.roadvision[.]com, dublweb.roadvision[.]com, and pnkaweb.roadvision[.]com. The prefixes (NWK, FCI, DUBL, PNKA) suggest these portals are deployed for specific municipal or regional clients, potentially indicating client-specific or deployment-specific interfaces. The age of these records ranges from February 2024 to August 11, 2026, with the most recent entry being only eight days prior to the TheGentlemen listing. The exposure of credentials over a period exceeding two years without rotation represents a significant systemic security failure. This prolonged period of unrotated access creates a substantial risk, not only for Roadvision Systems’ own operational data but also for the data and systems of the municipal and regional clients whose road management is administered through these portals. Any organization with credentials found in these logs should immediately revoke access and conduct a thorough audit of configuration changes dating back to February 2024.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.