servitelco Data Breach

Qilin ransomware, an active and prolific threat actor, has listed servitelco, a technology company based in Chile, as a victim on July 30, 2026. This listing was flagged by SOCRadar Dark Web Monitoring. The targeting of a technology firm like servitelco is significant, as compromises in this sector can have ripple effects on the clients and services they support. The credential exposure observed in relation to this incident further amplifies the potential impact. Qilin ransomware has been highly active, claiming 122 other victims in the 60 days leading up to this incident, making it one of the most prolific ransomware operations currently active. The group primarily targets the Business Services, Manufacturing, and Technology sectors, with a significant number of victims located in the United States, France, and Germany. Notable recent victims on Qilin’s listings include Byonyks, KLD Labs, TitanTV, Inc., and Sintax. The inclusion of servitelco not only aligns with Qilin’s pattern of targeting the technology sector but also expands the group’s geographical reach into Chile.

The analysis revealed a severe credential exposure related to servitelco. Twenty-five records were found associated with the domain servitelco[.]com. A majority of these records consist of employee credentials targeting Microsoft identity endpoints (login.microsoftonline[.]com and login.live[.]com), along with credentials for at least one internal employee portal. These findings point to multiple distinct corporate usernames, indicating a pattern consistent with corporate intrusion. The freshness of these credentials extends into late July 2026, and the direct exposure of Microsoft 365 sign-in credentials for several employees represents a high-severity telemetry finding. Qilin ransomware operations typically leverage infostealer logs for initial access. The observed pattern involves obtaining fresh logs, validating corporate credentials, gaining access to Microsoft 365, VPNs, or remote access portals, and subsequently deploying the ransomware. While the identified credentials are not definitively confirmed as the entry point used by Qilin in this specific instance, the surfacing of several employees’ Microsoft 365 login details shortly before the leak-site listing aligns precisely with the attack vectors this class of threat actor commonly exploits. The immediate next steps for servitelco should include resetting all passwords, revoking active sessions and tokens tenant-wide, and enforcing multi-factor authentication (MFA).

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.