Service IT Data Breach

Service IT, a business services organization based in Brazil, has been listed as a victim on the WorldLeaks group’s dark web portal, with the entry published on July 2, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. WorldLeaks has shown a strong targeting pattern in the manufacturing, business services, and healthcare sectors, primarily in the United States, India, and Pakistan. Service IT’s inclusion extends WorldLeaks’ geographic reach into Brazil within the business services sector.

Initial-access correlation against SOCRadar’s stealer-log telemetry surfaced a severe exposure for the service.com.br domain. The queried sample carried approximately ten sets of employee credentials on organization-owned systems, a similar number of external users (customers, suppliers, or third parties) appearing on internal systems, and a handful of corporate users surfacing on third-party services. High-value endpoints included an internal ADFS identity provider, a ServiceNow sign-on tenant, and internal mail infrastructure, all carrying corporate credentials, alongside third-party SSO and login portals. The exposure window spanned July 1 to July 2, 2026. For ransomware groups like WorldLeaks, infostealer-harvested credentials are a documented initial access vector. While this evidence doesn’t confirm WorldLeaks’ direct use of these credentials, the exposure on internal identity infrastructure aligns with typical ransomware kill chains. Recommended actions include immediate password resets on affected identity systems, enforced multi-factor authentication, and endpoint investigation for compromised accounts.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.