Contact us Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

INGKA GROUP

ingka.com

Group Lapsus$
Discovered 2026-06-13 10:02 UTC
Est. attack date 2026-06-13
Country SE

Description:

Full mapping of global e-commerce architecture and internal coworker platforms. Supply chain logistics, cloud infrastructure, and AI/MLOps repositories

Infostealer activity detected by HudsonRock

Compromised Employees: 1

Compromised Users: 5

Third Party Employee Credentials: 44


External Attack Surface: 6


Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • domainabusecscglobal.com
MX Records
  • ingka-com.t-v1.mx.microsoft.
TXT Records
  • docusign=34feea89-f747-476f-9b79-9853f67124e7
  • ingka-com-prodv2.azurewebsites.net
  • asv=7105be2e186278c0273a48d8b3920e93
  • 00DO300000BZ54v=1TBO30000000EhJ
  • 00D010000008rQf=1TBVE00000002pp
  • onetrust-domain-verification=23ecc5ad2d654f65b55adcb9e7e70e1d
  • paloaltonetworks-site-verification=3b57d93a57f0ea7876533d9a7ec61e7edbbb50282bbd5537be25f78e8849ceed
  • ingka-com-test.azurewebsites.net
  • atlassian-domain-verification=XQaNExsgGjatgumnVtqaXoN5Owtcebma89MyWUXytOIFNuXs8jnxjgFAKFIatpFI
  • 00D8C0000008gbm=1TBOv0000000k9J
  • autodesk-domain-verification=FAv7mF-Wa7G1Rv68Q8xh
  • google-site-verification=vyDa9WDnICfOMFrBveDxtQ6a71F4kepPl6aFzEkvNw0
  • astro-domain-verification=cm5xxgtq1061g01nap9s3cetw
  • adobe-sign-verification=cedca323afb86422862e301984996075
  • 00D8G00000046on=1TBca00000004q1
  • 00DO300000BZ56X=1TBO30000000EcT
  • 00DVD000002QtkV=1TBVD00000004Zt
  • hpe-greenlake-domain-verification=4446636842447473393130515a3966654151585a347856576849346a3370327a
  • ingka-com-prod.azurewebsites.net
  • jamf-site-verification=aLojw4yvhPCv1IwbEXPuEg
  • 00DSu000002IXAr=1TBSu00000000rF
  • adobe-idp-site-verification=036a3577b02a8246346dad0f45138a6240c2af831147232142079b4ee01dd1c4
  • mongodb-site-verification=lsPT0ICckHctxF8kPNykAETxL5QIAOGm
  • 00Df4000004nJ59=1TBVO00000001s9
  • MS=ms50141451
  • 00D4C0000000zGj=1TBU900000003M5
  • ibmid= 402dfd6a-c923-4b4b-8b0b-d48321ad0c03
  • atlassian-domain-verification=Wop3zDFh9asWl6EgYc9yrKKa6IAH842vlhuQZeywoS3EG9IwFvr8oDnGXYQzGaLp
  • v=spf1 include:_spf.ikea.com include:spf.protection.outlook.com -all
  • 00DSu0000018W29=1TBSu00000000w5
  • 00D4W000008GchQ=1TBPr000000010v
  • work-accounts-domain-verification=hXrwmD7olnTerSdYgtdXMwoRDVI6wU
  • 00DVF00000AetrF=1TBVF00000000xh
  • 00DTI000001lzU5=1TBTI0000000Jqf
  • 00Ddh0000000mnp=1TBdh00000006Wr
  • mindmanager-verification=0eedd0b69ba2d17599d2f73b8313cc5b1966a1224bce68df6decc65990677da1
  • onetrust-domain-verification=7cabf7c75a5946eb8e34dcb55488ac1a
  • 00DVE000002loxt=1TBVE00000002kz
  • 00DVC0000031OrU=1TBVC00000001qX
  • airtable-verification=1a7ed489e90d747183dc48f953dc38e2
  • onetrust-domain-verification=35acf95ab66146bbaf5fdd8209151b1e
Cloud / SaaS Services Detected
Adobe Atlassian Microsoft 365 Autodesk JamF OneTrust DocuSign

Leak Screenshot:

Leak Screenshot