SSF International Data Breach

INC Ransom has listed SSF International, a German firm operating under ssf-int.com and ssf-ing.de, on its dark web portal. The company, which provides engineering and professional services, exhibited a significant credential exposure profile, including dual compromise of its email and cloud storage infrastructure. This dual compromise is a strong indicator of conditions preceding ransomware deployment, suggesting that threat actors may have gained access to sensitive data and systems. The incident was listed on August 18, 2026. In the 60 days leading up to this listing, INC Ransom claimed 42 other victims. The ransomware group predominantly targets organizations in the Professional Services, Healthcare, and Business Services sectors. Its primary geographic focus has been on the United States, the United Arab Emirates, and Canada. By targeting SSF International in Germany, INC Ransom is expanding its reach into continental Europe. Recent victims claimed by INC Ransom include NYK Law Firm, Cambria Law Firm, and Stuart & Associates Commercial Flooring, Inc., indicating a pattern of activity in the professional services sector.

SOCRadar’s analysis of stealer-log telemetry for ssf-int[.]com revealed five employee credentials associated with the @ssf-int[.]com domain. These credentials were harvested from Hosteurope/OX webmail and Sync[.]com, a cloud file storage service. The identified logs date from April 13 to May 25, 2026, covering a 42-day period with no apparent rotation of the compromised credentials. The exposure of credentials affecting both email infrastructure and cloud file storage aligns with prerequisites for successful ransomware deployment. While these findings do not definitively confirm that INC Ransom utilized these specific credentials for an attack, the observed exposure profile is consistent with the typical patterns associated with their operations and pre-deployment reconnaissance. Treat all identified @ssf-int[.]com credentials as compromised. Audit email and file-sharing access logs for the April–May 2026 window and assess whether the Sync[.]com account contains materials exfiltrated as part of this incident.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.