Sistemas da SOCAR e contas de prestadores turcos · Breach

[Single source] Actor claims SOCAR breach through Turkish contractors

Nov 11, 2026 · 1 min read

An actor called Grim claims months-long access to SOCAR-linked systems after compromising Turkish contractor accounts. The reportedly published data includes credentials, password hashes, identity numbers, and internal records. SOCAR and the contractors should investigate affected accounts and reset exposed credentials.

By HIFY Radar newsroom Updated 11/11/2026 01:08 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Alleged

A post by DarkWebInformer says an actor called Grim claims to have accessed SOCAR-associated systems for several months after compromising accounts belonging to Turkish contractors. The post says SQL files and screenshots were published as evidence, but explicitly describes the claim as unverified.

What happened

Alleged

According to the post, the alleged entry point was accounts held by third-party contractors in Turkey. Grim reportedly claims those accounts provided continuing access to systems associated with SOCAR, Azerbaijan's state-owned oil company.

Why it matters

Inferred

If authentic, the reported material could expose both corporate access and highly sensitive personal records. The listed data ranges from credentials and password hashes to national identity numbers, employment information and criminal-record details.

What to do

Inferred

SOCAR and the relevant contractors should preserve logs, investigate contractor accounts, identify any affected systems and rotate potentially exposed credentials. People whose identity or employment records may be involved should be notified only after the material and its scope are validated.

Confirmed and still uncertain

Observed

What is observable is that DarkWebInformer published the allegation and attached an image. The supplied evidence does not include confirmation from SOCAR or the contractors, independent validation of the files, a technical incident report, or a verified count of affected people and systems.

What people are saying

Alleged

DarkWebInformer attributes the breach claim to Grim and says the actor presented SQL database files and screenshots as proof. The same post cautions that the claim remains unverified.

Evolution

Alleged

The alleged sequence begins with the compromise of Turkish contractor accounts, continues with claimed access to SOCAR-associated systems for several months, and ends with the reported publication of database files and screenshots. No precise dates for those stages are provided.

Reach

Observed

1 independent groups, 1 updates, and 2 engagements.

Technical detail

Observed

The only described access path is compromised third-party contractor accounts. SQL database files and screenshots are said to support the claim, but the evidence provides no malware analysis, access logs, vulnerability details, authentication method or independent forensic findings.

Sources and evidence

Observed

This report is based on one X post from DarkWebInformer. It is a secondary account of Grim's claims, not direct confirmation from SOCAR, an affected contractor or an independent investigator, so the alleged breach and exposed data should be treated as unverified.