TOWILL Data Breach

TOWILL, a Professional Services firm based in the United States, has been identified as a victim by the bravox ransomware group. The listing occurred on September 20, 2026. This incident falls within bravox’s recent targeting patterns, as the group frequently targets organizations in the United States, and Professional Services is a sector they commonly exploit. In the past 60 days, bravox has claimed responsibility for incidents involving 8 victims, primarily targeting organizations in the US, Italy, and the UK. The ransomware group’s most frequently exploited industries include Technology, Other, and Retail & E-Commerce. TOWILL’s inclusion aligns with these prevalent targeting trends, suggesting the group’s ongoing focus on these sectors for potential data extortion.

One corporate credential associated with towill[.]com was discovered on accounts[.]logme[.]in, a platform linked to LogMeIn remote access. This credential was dated to September 2025, indicating it was exposed for approximately one year prior to the bravox ransomware listing. Such a significant time gap between credential exposure and a ransomware claim is often indicative of credentials circulating in underground marketplaces for an extended period before being utilized for malicious purposes. The presence of this LogMeIn credential presents a credible potential pathway for initial access by ransomware actors. Remote access tools are a frequently documented vector for ransomware deployment. Organizations should investigate whether the compromised account remained active at the time of bravox’s intrusion and whether Multi-Factor Authentication (MFA) was enforced on the LogMeIn instance to mitigate such risks.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.