Service Evaluation Concepts Data Breach

Service Evaluation Concepts, a professional services firm based in the United States, was listed on August 11, 2026, by the Qilin ransomware group. This listing is notable because, unlike many of Qilin’s recent claims, it was accompanied by evidence of severe credential exposure detected in SOCRadar’s stealer-log telemetry. The company operates within the professional services sector, which is a common target for ransomware operations. In the 60 days preceding this listing, Qilin claimed over 150 victims, marking it as one of the most active groups monitored by SOCRadar. The group predominantly targets the manufacturing, business services, and professional services industries, with a significant majority of victims located in the United States, followed by Germany and France. Service Evaluation Concepts aligns with this pattern, being a US-based professional services firm, similar to other recent victims like John C Saunders, CPA, Community Management Associates, The Myers Y Cooper, and EISNER ZT GMBH.

The primary point of interest in this incident is the stealer-log telemetry associated with serviceevaluation[.]com. A sample of 25 records revealed that 16 contained employee credentials for authentication and operational portals, and an additional 8 belonged to customers or third-party users accessing the same systems. These targeted endpoints were critical, including the company’s primary employee login portal, an operational login portal, and associated business application logins across various subdomains. This suggests direct authentication access rather than incidental consumer data exposure. The credentials found were logged between July 1 and August 11, 2026, with some accounts appearing multiple times, indicating either unrotated credentials or repeated compromises of the same endpoints. The presence of these credentials points to a significant corporate intrusion risk. While the stealer-log data does not definitively confirm that Qilin used these specific credentials for entry, the pattern of employee credentials on internal authentication portals surfacing over an extended period without rotation is consistent with typical ransomware attack chains. Infostealer-harvested credentials commonly serve as an initial access vector for groups like Qilin. Threat actors or access brokers often purchase these logs, validate the credentials, and then use them to gain access to systems such as Microsoft 365, VPNs, or remote-access portals before deploying ransomware. Given the observed credential exposure and the typical modus operandi of Qilin, it is recommended that Service Evaluation Concepts prioritize immediate credential rotation for all affected accounts and systems. Implementing or reviewing Multi-Factor Authentication (MFA) enforcement on all relevant portals is crucial. Additionally, a thorough review of access logs across the identified exposure window (July 1 to August 11, 2026) is necessary to detect any unauthorized activity. Continued monitoring of dark web feeds and stealer logs for any further evidence related to the organization is also advised.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.