The Fifty/50 Data Breach

The Fifty/50, a US-based organization, was listed by the Qilin ransomware group on its dark web portal on September 22, 2026. While the specific sector of The Fifty/50 could not be determined from the listing metadata, its confirmed US presence aligns with the ransomware group’s recent targeting patterns. SOCRadar identified this listing through its Dark Web Monitoring service. It is important to note that such listings are not independently verifiable and do not definitively confirm a data breach. Qilin has been highly active, claiming 248 other victims in the 60 days preceding this report, making it the most prolific group during that period. US organizations constitute the largest country cohort in Qilin’s recent victimology, with a notable concentration in the Manufacturing, Professional Services, and Other industries. Previous US victims include Montana Civil Contractors, ADM, Resolve Law Group, and RoadEx America. The Fifty/50’s US location places it directly within Qilin’s primary geographic focus, irrespective of the unknown sector data.

SOCRadar’s query of stealer-log data for the domain “thefifty50[.]com” returned no records within the analyzed dataset slice. However, this result should be interpreted with caution. The query was bounded and paginated, meaning that credentials could potentially exist under alternate corporate domains or aliases that were not included in this specific dataset. Therefore, the absence of records in this particular query does not definitively rule out the possibility of a compromise. The known capabilities of infostealers to harvest credentials can significantly support ransomware operations by providing initial access. While no direct correlation was found in the stealer-log data for The Fifty/50, the potential for credential exposure under unquerried domains or aliases means that vigilance remains necessary. Organizations are advised to conduct thorough credential hygiene reviews and to monitor for any further indicators of compromise. Continued dark web and stealer-log monitoring for The Fifty/50 remains appropriate. Proactive credential hygiene checks, including password rotation and multi-factor authentication reviews for all access points such as Microsoft 365, VPNs, and remote-access portals, are strongly recommended. Attention should also be given to monitoring any alternate corporate domains that may be associated with the organization.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.