TQC S.A. Data Breach

dragonforce listed TQC S.A., a Peruvian professional services firm, on its leak site on October 11, 2026. This listing is part of a broader campaign by the ransomware group, which claimed 23 victims in the 60 days preceding this report. The group primarily targets sectors including ‘Other,’ Manufacturing, and Retail & E-Commerce, with a geographic concentration in the US, Brazil, and Taiwan. While Peru is not among the group’s top target countries, its inclusion is consistent with dragonforce’s activity in Latin America, suggesting a continued interest in the region. The nature of TQC S.A.’s business in professional services may have made it an attractive target for cybercriminals seeking access to sensitive client data or operational information. The incident involving TQC S.A. is notable due to the extremely compressed timeline observed between the credential harvest and the ransomware listing—just five days. This rapid sequence suggests direct operationalization by initial access brokers (IABs) rather than a longer resale cycle for compromised access. The presence of an expense management system, gastos.tqc.com[.]pe, alongside the broader credential exposure, indicates that the attackers may have gained access to financial transaction data in addition to identity and organizational systems, thereby expanding the potential impact of the breach.

SOCRadar CTI analysis of the dragonforce ransomware attack on TQC S.A. (Peru) revealed severe exposure in the sampled data. A total of 13 records were identified, all classified as Category A, signifying employee credentials found on organizational systems. The primary endpoint for this credential exposure was Microsoft Identity Platform (MS IdP), indicating that credentials associated with Microsoft 365 services were compromised. Additionally, the internal expense management system, gastos.tqc.com[.]pe, was also implicated. The discovered credentials were logged between October 4 and October 6, 2026, five days prior to dragonforce listing TQC S.A. on their leak site on October 11, 2026. This rapid progression from data compromise to public listing points towards a highly efficient operation, potentially driven by direct IAB involvement. The compromise of MS IdP credentials provides potential access to a wide array of Microsoft 365 services, including email, SharePoint, and Teams, as well as any other applications integrated with the organization’s identity infrastructure. This suggests a substantial initial foothold for the threat actors. The timeline and nature of the compromise highlight the critical importance of robust security practices. The rapid credential harvesting and subsequent leak suggest a sophisticated attack chain. The exposure of employee credentials via MS IdP, a common gateway to cloud services, underscores the need for stringent identity and access management. Furthermore, the inclusion of an internal expense management system in the compromised data indicates the potential for attackers to access sensitive financial information. Action Required: Rotate all Microsoft IdP credentials immediately. Audit gastos.tqc.com[.]pe access logs for the October 4–6 window. Enforce MFA on all SSO-integrated applications. Engage endpoint detection to confirm whether infected workstations remain active.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.