TEXMA International Data Breach

dragonforce claimed TEXMA International, a Taiwanese manufacturing organization, on its leak site on 2026-10-10. This claim highlights a potential data breach impacting a company operating within the manufacturing sector in Taiwan. dragonforce listed 23 victims in the past 60 days, targeting Other, Manufacturing, and Retail & E-Commerce sectors. Its top three geographies are the US, Brazil, and Taiwan—placing Taiwan among the group’s confirmed priority countries. Taiwanese manufacturers appear repeatedly in dragonforce’s victim set, consistent with deliberate sector and geography targeting rather than purely opportunistic scanning.

Stealer-log verdict: severe_exposure_in_sample. The 2-record sample is exclusively Category C (corporate accounts on third-party services): both records are Fortinet support portal credentials, logged between 2026-02-22 and 2026-08-10. The Fortinet support portal is a high-value target in IAB operations. Organizations managing Fortinet firewall and VPN appliances use this portal for firmware downloads, configuration guides, and support tickets that may contain network topology details. A compromised Fortinet support account also enables impersonation against the victim’s firewall administrators. Fortinet VPN gateways are a primary remote-access vector for ransomware operators, making this exposure directly relevant to initial access. The Fortinet portal exposure fits a recognized IAB pattern: stealer-harvested credentials for a vendor support portal are cross-referenced against known Fortinet deployments to identify VPN gateway entry points. dragonforce’s focus on Taiwan and the nature of the exposed credentials suggest this wasn’t incidental. Taiwanese manufacturers relying on Fortinet infrastructure should treat this combination as a high-risk signal. Rotate Fortinet support portal credentials immediately. Audit support ticket history for any network topology disclosures. Review VPN gateway logs for unauthorized authentication attempts, particularly from unfamiliar IP ranges during the February–August credential exposure window.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.