SITTNAK Lojistik A.Ş. Data Breach

Doommageddon listed SITTNAK Lojistik A.Ş., a Turkish transportation company (sittnak[.]com[.]tr), as a claimed victim on 2026-08-30. SOCRadar CTI identified 13 corporate third-party credentials, all tied to a single employee identity across DFDS logistics platforms, with activity spanning 2025-05-27 to 2026-07-17. The single-identity pattern is a distinctive indicator: one compromised workstation was harvesting credentials across every DFDS-connected platform that employee accessed, over a period of more than a year. Doommageddon has listed 3 victims in the past 60 days, with targeting concentrated in Turkey and sector focus on Transportation and Other. SITTNAK Lojistik A.Ş., a Turkish transportation entity, fits directly within the group’s established geographic and sector profile. Doommageddon is a low-volume, focused operator; its deliberate selection of Turkish logistics targets suggests sector-specific intelligence gathering or access broker sourcing within the Turkish market.

SOCRadar CTI’s analysis returned severe_exposure_in_sample for sittnak[.]com[.]tr. All 13 flagged records tie to a single employee identity across DFDS logistics platforms — a freight coordination and logistics management system used across the European transportation sector. Timestamps span 2025-05-27 to 2026-07-17. The DFDS platform access indicates the compromised employee had supply chain coordination responsibilities, providing the credential holder with visibility into shipment schedules, counterparty data, and logistics documentation. The data collected suggests a prolonged period of credential harvesting, potentially from a single compromised workstation. This sustained activity over more than a year indicates a significant risk of unauthorized access, which could be leveraged for further exploitation, including ransomware deployment. The specific nature of the DFDS platform, used for logistics management, means that exposed credentials could grant access to sensitive operational data, shipment details, and potentially customer or supplier information. Assessment Identify and isolate the affected employee’s device immediately. Rotate all DFDS platform credentials associated with the identified identity and notify DFDS of the third-party credential exposure. Audit DFDS platform access logs from 2025-05-27 to 2026-07-17 for unauthorized data queries or bulk export activity. The single-workstation origin of all 13 records makes device forensics a viable path to understanding the full scope of the compromise.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.