SUPERPACK Data Breach

SUPERPACK, an industrial packaging company, was listed on krybit’s dark web leak site on October 2, 2026. More significantly, stealer-log records tied to SUPERPACK’s infrastructure included a fresh entry dated October 4, 2026. This indicates that credentials were still being harvested after the ransomware listing was already public, suggesting an active infostealer infection running concurrently with the krybit intrusion, rather than as a historical precursor.

SOCRadar’s stealer-log intelligence identified five distinct corporate email identities compromised across Microsoft identity platform (IdP) accounts, Google identity provider accounts, and SMTP email infrastructure. Compromise of Microsoft and Google IdP credentials provides attackers with access to cloud infrastructure, allowing them to pivot into file storage, email, and any SaaS integrations tied to those identities. The compromise of SMTP credentials offers another avenue for exploitation, potentially for repurposing email for lateral movement or intercepting internal communications. Krybit affiliates are known for maximizing data exfiltration before encryption, and this credential profile illustrates the potential breadth of their operations. The close timeline between the freshness of credentials and the ransomware listing highlights the industrialized pipeline between infostealer operations and RaaS affiliates purchasing real-time feeds. Force password resets for all five identified identities immediately and audit every Microsoft Entra and Google Workspace account against current stealer-log intelligence. Enforce phishing-resistant MFA—FIDO2 hardware keys, not SMS—across all cloud identity providers. Conduct a dedicated email security audit for the SMTP compromise, specifically looking for unauthorized forwarding rules, delegations, or inbox access. Organizations operating similar Microsoft-Google hybrid identity environments should consider credential freshness in stealer feeds as a leading indicator of active attacker presence, necessitating proactive investigation beyond historical context.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.