Sports Events365 Data Breach

Qilin listed Sports Events365, a sports ticketing and events platform, on its dark web leak site on October 2, 2026. SOCRadar identified a severe credential exposure profile spanning May through September 2026, covering the organization’s supplier-facing portal, the helponclick customer support platform, and one employee identity. Twenty-three distinct customer credential records were captured across that window, affecting both employee and customer-facing authentication systems. Qilin, also known as Agenda, is known for its customizable ransomware payloads and its practice of conducting extended reconnaissance before encryption. The group specifically targets web-facing portal and SaaS platform infrastructure, utilizing supplier and customer authentication systems as pathways for lateral movement. This operational discipline positions Qilin as a significant ransomware threat to businesses operating consumer-facing platforms.

Qilin listed Sports Events365 on its dark web leak site on October 2, 2026. This listing was correlated with stealer-log data that revealed a credential exposure profile for the organization between May and September 2026. The compromised data included access to the company’s supplier-facing portal, the helponclick customer support platform, and at least one employee credential. Additionally, 23 distinct customer credential records were identified. Both employee and customer-facing authentication systems were impacted. The identified stealer-log records do not definitively confirm that Sports Events365 was infiltrated for the purpose of encryption or ransomware deployment. However, the exposure of supplier portal access, employee credentials, and customer records presents a significant risk. These compromised credentials could be used by threat actors to gain unauthorized access, conduct further reconnaissance, or facilitate a ransomware attack. The nature of Qilin’s targeting of web-facing portals and SaaS infrastructure, combined with this credential exposure, aligns with their typical operational methodology. The 23 identified customer credentials require immediate notification. It is imperative to force-reset all customer portal and employee credentials. Furthermore, an audit of the supplier portal and helponclick account for unauthorized access during the May through September 2026 window is necessary. Organizations should determine whether the accessed payment card or personal data triggers PCI DSS incident reporting or data protection authority notification requirements. Implementing multi-factor authentication (MFA) and session anomaly detection on all customer-facing authentication portals is also recommended.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.