Group:
Worldleaks
Discovered by ransomware.live: 2025-06-27
Estimated attack date:
2025-06-27
Country:
Description:
[AI generated] Tech Mahindra is a leading global provider of IT, BPO and consulting services. Based in India, it is part of the Mahindra Group. With over 125,000 employees across 90 countries, it offers solutions that help clients enhance their business processes. Its offerings include customer strategy, data analytics, cloud infrastructure, and digital transformation services. They work with clients across various sectors including telecom, healthcare, manufacturing, banking and financial services.
Infostealer activity detected by HudsonRock
Compromised Employees: 3282
Compromised Users: 5904
Third Party Employee Credentials: 3877
External Attack Surface:
200
DNS Records:
The following DNS records were found for the victim's domain.
- techmahindra-com.mail.protection.outlook.com.
- _2rq3fokmjopqkzp97lazj8o73inhc5h
- box-domain-verification=4ddd0babd72c2c8598291015e44a80212f87ff497acca03e96c5c854bdbbf043
- atlassian-domain-verification=ryRbflywjrNYa0Tll0MtSRsnxQYflUjz6L3FUhPSPG9kLiLeNdbBPU5j3IbFiUqx
- mou0AlwiUxqJhPjs81cdDSWQ3jsDMRl5Kn8Xe7v3p+y5QoYQbLjW/bQs03KJxVaXKQs/9mlSHCOcXPE6YNifmA==
- atlassian-domain-verification=wBrOFASBvgMlndoPMoLnMXMQ0t0IIHBccg5cHWmjXhAG9EC6iB9ECCaYRauSjrH8
- cisco-ci-domain-verification=43add812b931648ada7b7f1ff1180518ca774678da26842cc0c4522179c9758c
- google-site-verification=3qiu0Ide6c_Gope8k2o9oecD6hKbWmnbjWHc4wp3gMw
- apple-domain-verification=nZJtwjBRd3g62bv7
- zoho-verification=zb56422924.zmverify.zoho.com
- vmware-cloud-verification-3f13823e-3431-4b3f-946c-497a80925af0
- wombat-verification=3KwxVCQV1HEp-aRXRTKKaZ5G0frhk
- v=spf1 mx include:spf.protection.outlook.com include:_spf.google.com " " ip4:119.151.8.99/32 ip4:119.151.8.112/31 " "ip4:203.143.187.82/31 ip4:203.143.187.84/30 ip4:191.41.204.80/29 ip4:103.23.24.78/32 " "ip4:103.23.26.70/32 ip4:119.151.20.178/32 ip4:13.126.171.136/32 ip4:119.151.20.179/32 ip4:129.145.20.114/32 -all
- google-site-verification=VpIfniqUnwUwajlc0EOcKUJg54-fFSXps7qyE2J13wI
- NqA107OZxFT3GGSumGoeMFxVsIV03sUyQY5H5nbffSc=
- duo_sso_verification=fE7QwooS3gEzoDaYrAw6CDGiMPeAsTJGDsaBgh54a1xpvf0hetU6n6UlZ74dmGXc
- _np1dvjpumbffc7c9bhqyldrvqj6qp5u
- mongodb-site-verification=tGHKhQ3sT7vJGNoofFBzim544ND2MBuC
- jamf-site-verification=RKJ23nlNbYXTomhKfn4kFA
- duo_sso_verification=9YXDYXB3qHsNLubjB8bCEvMhIDy00qsW6uYSdi2pxczlp3MZVAvPwXmzpFFPgZV1
- _iwdxd3znjvbpor9oxrt7ueu97pre0d3
Cloud / SaaS Services Detected
Apple
Atlassian
Box
JamF
Zoho Campaigns
Cisco
Cisco Duo
Leak Screenshot:
Legal Disclaimer:
Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession,
hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data.
This platform indexes only publicly visible information posted by ransomware operators and
open web sources without accessing or obtaining the underlying stolen content.
The service is provided to support public awareness, legitimate research, and cyber-resilience.
No stolen personal or confidential data is collected or distributed via this site.