Hackers Use Stolen Credentials to Fake Major Data Breaches
Original title: Hackers Use Stolen Credentials to Fake Major Data Breaches and Pressure Companies for Money
Hackers access limited corporate data using stolen credentials and present it as major breach evidence to pressure companies for payment.
Hackers are using exposed credentials to access limited corporate data, then presenting that access as evidence of major breaches to pressure companies into paying. The findings concern external attacker activity affecting third parties, not a compromise of ReliaQuest’s environment. ExfilSquad publishes companies that fail to meet an agreement, but researchers observed missed publication deadlines and listings without supporting samples. Organizations named on leak sites increased 30% during Q3 2026.
Unconfirmed: The assessment remains a likely explanation, not a confirmed reconstruction of every claimed incident.
- ExfilSquad identified as likely example of exaggerated ransomware reporting
- New listings may combine fresh intrusions, rebrands, recycled information, and false allegations
- GitHub secret-scanning recommends rotating exposed credentials immediately
Impact: pressure companies for money by claiming major data theft
- 1.compare published samples with internal records
- 2.rotate exposed credentials
- 3.revoke exposed secrets
- Threat actors
- ExfilSquad
- Organizations
- ReliaQuest
From the original article
3 min read at gbhackers.com
Hackers are using exposed credentials to access limited corporate data, then presenting that access as evidence of major breaches to pressure companies into paying. The findings concern external attacker activity affecting third parties, not a compromise of ReliaQuest’s environment. They highlight a distinction: authentic leaked records do not automatically prove the extensive network intrusion an […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.