Thrifty Building Supply Data Breach

Qilin ransomware has added Thrifty Building Supply, a United States-based building supply retailer, to its leak site on August 19, 2026. The Qilin group has been highly active, claiming approximately 196 victims over the past 60 days. The group’s targeting often focuses on US commercial entities, making them a frequent victim country. The listing of Thrifty Building Supply appears to follow a common pattern for the group, targeting a mid-size American company without a particularly specialized industry. Recent activity from Qilin indicates a broad targeting strategy. Among other US organizations recently listed by Qilin are Teikoku USA and Double H Equipment, both in the manufacturing sector, Spoonful of Comfort in hospitality, and Arnall Golden Gregory in professional services. This wide net cast across various sectors, including retail, demonstrates Qilin’s opportunistic approach to identifying potential targets.

SOCRadar’s query for stealer-log records associated with the domain “thriftybuildingsupply[.]com” returned no results. This finding indicates that no positive correlation was found within the queried dataset for this specific domain. However, the absence of records in this bounded sample does not definitively confirm that the organization is unaffected. It is important to note the limitations of this query. The search covered only a limited sample of stealer-log data, and credentials might exist under alternate corporate domains, or within personal email aliases used by staff. Furthermore, records may exist in data feeds not included in the queried dataset, or credentials may have been used and rotated prior to their indexing. Therefore, a null result should be interpreted as a lack of positive signal rather than definitive proof of no compromise. Qilin typically gains initial access by leveraging credentials harvested by infostealers, which are then acquired from underground markets. These compromised credentials are used to access systems such as Microsoft 365, VPNs, or other remote-access portals, paving the way for ransomware deployment. The current lack of stealer-log evidence for Thrifty Building Supply does not rule out the possibility of compromise through other means. Continued monitoring of dark web marketplaces and stealer logs, alongside proactive credential hygiene checks, password rotation, and multi-factor authentication review, is recommended.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.