SK Global Software Data Breach

Akira listed SK Global Software — a South Korean enterprise software and IT services company — on its dark web portal on November 3, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. SK Global Software delivers business applications and digital transformation solutions to South Korean and regional enterprise clients, giving the group’s claim potential reach well beyond the company itself. The broader risk isn’t limited to SK Global: enterprise software providers typically hold elevated access to client systems and data environments, so a compromise at the vendor level can translate directly into exposure for its customers. Akira is one of the most active ransomware groups operating today, maintaining a consistently high rate of new victim listings across its leak portal. North American targets have historically led its victim roster, but the group regularly pursues technology firms in Asia and Europe when access is available through its network of initial access brokers — criminal intermediaries who sell network entry points. Its concurrent November 2026 listings include Pelham Plastics (Manufacturing) and Bison Bag (Retail), confirming that Akira’s targeting in this window is sector-agnostic. Technology and software firms, however, are targeted specifically for the downstream access they carry, and SK Global Software fits this pattern as a vendor with likely access to regional enterprise client environments.

SOCRadar’s stealer-log telemetry — a dataset of credentials harvested by malware from infected employee devices and sold underground — returned no records for SK Global Software. No confirmed corporate domain was on file. However, South Korean technology companies often present a broad credential surface through multiple domain configurations, regional hosting, and developer platforms, none of which a single-domain query captures. This isn’t a clean result; it’s a coverage gap. The absence of records in the queried dataset does not confirm that the organization is unaffected — credentials may exist under alternate corporate or developer-facing domains, or in feeds outside the queried dataset, and harvested credentials may be sold to initial access brokers before they are ever indexed. Infostealer-harvested credentials of this kind can support ransomware operations when brokers validate them and sell network entry points — including access to corporate accounts, Microsoft 365, VPNs, or remote-access portals — which Akira relies on for access to targets such as this one. That said, no evidence confirms this exact access path was used against SK Global Software; the scenario remains a possibility rather than an established fact. Security teams with visibility into SK Global Software’s domain assets should run targeted stealer-log queries across all associated corporate and developer-facing domains now, monitor alternate domain configurations, and review Microsoft 365, VPN, and remote-access activity. If your organization is a vendor or partner, assess what access SK Global Software’s accounts hold within your own environment and restrict as appropriate. Continued dark web and stealer-log monitoring is advised.