TERRACOM & MONTCAU Data Breach

Majinahanashi listed TERRACOM & MONTCAU on its dark web portal on September 1, 2026, as an identified victim. SOCRadar’s Dark Web Monitoring service flagged this listing. TERRACOM & MONTCAU appears to be a Spanish technology services or IT infrastructure firm. The combined name suggests a potential merger or joint venture between two entities that now operate under a unified brand within the Spanish market. The targeting of a technology firm, particularly one operating in Spain, aligns with certain trends in ransomware operations that seek to disrupt critical IT infrastructure or exfiltrate sensitive client data. Majinahanashi has claimed responsibility for 22 other victims within the prior 60 days. The group’s primary targets are typically within the Hospitality, Retail and E-Commerce sectors, as well as a broad category encompassing other industries. This particular listing within the Technology sector indicates a scope that extends beyond its most commonly targeted verticals. Geographic concentrations for Majinahanashi have been observed in Malaysia, Colombia, and the United States. There is a notable overlap in European and Technology-sector targeting with prior identified victims such as ALTAIR and PCA Group Sdn. Bhd., suggesting a strategic approach to victim selection that may not be confined to specific regions or industries.

A stealer-log query performed for the domain terracom[.]es returned no records within the queried sample. It is crucial to note that a null result from this type of query does not definitively confirm that the organization is unaffected by credential exposure. The query is limited to a specific, paginated slice of data and does not encompass all potential sources of exposed credentials. Credentials may exist under an alternative corporate domain, such as montcau[.]com, or be sourced from VPN-credential repositories that were not included in this particular dataset. For Spanish IT firms, common alternative access vectors that could be exploited by threat actors include exposed remote desktop services and VPN appliances that have unpatched vulnerabilities. This is particularly relevant for common solutions like Fortinet and Cisco ASA devices. The presence of exposed credentials, even if not directly found in the initial stealer-log query, can significantly lower the barrier for ransomware operators to gain initial access. This can be achieved through credential validation against corporate accounts or by leveraging compromised credentials for remote access portals, including VPNs and Microsoft 365. Despite the null stealer-log result, the listing of TERRACOM & MONTCAU fits Majinahanashi’s observed pattern of targeting mid-size technology firms in non-English-speaking markets. Organizations that share infrastructure, supply chain relationships, or cloud providers with TERRACOM & MONTCAU should cross-reference the terracom[.]es and montcau[.]com domains in their own threat intelligence feeds. Continued dark web and stealer-log monitoring is recommended, along with proactive credential hygiene checks, password rotation, and multi-factor authentication review for all critical systems.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.