Ransomware needs a way in. Stolen credentials are the cheapest one.
MERCOR Ransomware Attack
mercor.comData extortion
Data has been published on the ransomware group's leak site.
Overview
View group profileDomain
mercor.com
Industry
Professional Services
Country
United States
Discovered
4 months ago
Attack date
Mar 31, 2026
Confidence
90%
Severity
Critical
Status
Data Leaked
Threat group
lapsus$Total victims
24
First seen
Mar 2026
Last seen
Jun 2026
Group status
active
Sophistication
0
Impact score
105
Threat level
2.4/10Aggressiveness5/10
Lethality0.2/10
Criticality1.9/10
Status breakdown
Data Leaked
this victim
4.2%3Negotiating1.4%1
Claimed94.4%67
Victim's position within group
Industry
Professional Services
Known target sector
Country
United States
Frequently targeted country
Other victims
View all (71)Same group · lapsus$
Group activity
Monthly attacks · lapsus$
24
total · avg 6/mo