Skaff Group Data Breach

Skaff Group, a conglomerate with operations spanning construction, real estate, and related business sectors, was listed as a victim on Rhysida’s dark web leak site on October 2, 2026. Rhysida claims to have compromised the organization’s systems and exfiltrated sensitive corporate data. The listing has not been independently verified through open-source sources as of this report. Rhysida has sustained consistent operational activity since emerging in 2023. Construction, healthcare, government, and education are the group’s recurring sectors. Their primary access vectors include phishing campaigns and the exploitation of VPN vulnerabilities. Lateral movement within victim networks typically relies on living-off-the-land techniques and credential harvesting. Rhysida has previously listed victims across the Middle East, alongside targets in North America and Europe, indicating a broad geographic reach.

SOCRadar’s stealer-log query for Skaff Group’s known domains returned no matches. This null result does not confirm that the organization is unaffected. Construction conglomerates often engage numerous subcontractors and vendors, who may possess varying degrees of network access. Rhysida could have gained entry through a third-party connection or by exploiting an internet-facing service, neither of which would necessarily generate stealer-log records under the victim’s primary domain. The data Skaff Group likely possesses, such as project designs, land and property records, client financial data, and contractor relationships, carries significant extortion value for a double-extortion attack strategy. The Rhysida listing is considered credible given the group’s documented activity in the Middle East and the profile of the targeted conglomerate. The possibility of third-party or supply chain access remains a viable entry path, especially considering the extensive vendor ecosystem likely maintained by a company of Skaff Group’s nature. Initiate a forensic investigation to determine the precise intrusion vector and the full scope of any data exfiltration. It is recommended to review and restrict third-party vendor access to internal networks. Assess notification obligations for project clients and partners who may have had their data exposed. Enforce multi-factor authentication on all VPN and remote access solutions. Conduct thorough security assessments of all internet-facing project and document management platforms.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.