SC PaderTeG Cabluri Electrice Data Breach

Qilin ransomware listed SC PaderTeG Cabluri Electrice, a Romanian electrical cable manufacturer, as a victim on its dark web portal on August 25, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring. This is Qilin’s second Romanian victim published on August 25, 2026, alongside AGROLAND S.A., suggesting a possible targeting focus on Romanian industrial companies in this period. Qilin claimed 217 other victims in the prior 60 days. The group has shown a strong targeting pattern in Manufacturing, Professional Services, and Agriculture and Food Production sectors, with victims primarily concentrated in the United States, Germany, and Italy. Recent listings with overlapping manufacturing or Romanian profiles include Harplast SRL, Black Cat Engineering & Construction WLL, S.E.M.P. s.r.l., and Gindre India. The listing is consistent with Qilin’s documented focus on European manufacturing, with Romania emerging as a target geography alongside more established Qilin victim clusters in Germany and Italy.

Stealer-log telemetry query against paderteg[.]ro returned no records. Datasets are paginated and sampled; credentials may have surfaced in unqueried feeds, been rotated before indexing, or been harvested via personal email aliases outside a domain-filtered query. Infostealer credentials are a common Qilin initial-access vector: brokers source fresh logs from underground markets, validate corporate credentials, and use them to access Microsoft 365, VPN, or remote-access portals before ransomware deployment. The absence of evidence here doesn’t rule that scenario out — CTI teams should maintain monitoring and run proactive credential-hygiene checks rather than reading a null result as exoneration.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.