Tekpak Inc. GoCanvas Enterprise · Breach

[Single source] Claim: Actor sells access to Tekpak dashboard, 347,000 records claimed

Nov 09, 2026 · 1 min read

An actor named razq is selling alleged access to industrial manufacturer Tekpak's GoCanvas Enterprise dashboard for $300. The listing cites a compromised employee account with multi-factor authentication disabled, exposing roughly 347,000 internal records dating back to 2014. Tekpak has not commented on the claim.

By HIFY Radar newsroom Updated 11/09/2026 11:52 AM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Alleged

An actor using the handle "razq" is selling alleged initial access to Tekpak Inc., a U.S. industrial manufacturing and automation company, for $300, according to a post by DarkWebInformer on X. The listing claims the purchase would grant access to the company's GoCanvas Enterprise dashboard through a compromised employee account.

Alleged

The seller claims the account exposes 347,000 internal records dating back to 2014, including supply chain logistics, quality control evaluations, and operational reports. DarkWebInformer notes the claim is currently unverified.

What happened

Observed

A listing surfaced advertising initial access to Tekpak corporate dashboard credentials for $300. The actor behind the listing uses the handle "razq".

Alleged

According to the listing, the access is achieved through a compromised employee account on Tekpak's GoCanvas Enterprise dashboard, with multi-factor authentication reportedly disabled on that account.

Alleged

The listing further claims the account provides access to 347,000 internal records dating back to 2014, spanning supply chain logistics, quality control evaluations, and operational reports. No verification of these claims has been presented.

Why it matters

Alleged

Tekpak is described in the listing as a U.S. industrial manufacturing and automation company, meaning the alleged data: supply chain logistics and operational reports: could be sensitive to the company's operations and partners if the access is genuine.

Inferred

The low asking price of $300 for claimed access to 347,000 records suggests this could be an accessible entry point for a range of buyers, from ransomware operators to data brokers, should the claim prove true.

Inferred

The claim that multi-factor authentication was disabled on the compromised account highlights a common initial-access vector: credential compromise combined with absent MFA on enterprise SaaS dashboards.

What to do

Inferred

Organizations using GoCanvas or similar enterprise dashboards should review employee accounts for anomalous access and enforce multi-factor authentication across all accounts, given the alleged vector in this listing.

Inferred

Security teams tracking this actor should treat the "razq" listing as unconfirmed until independent verification of the access or the 347,000-record claim is obtained, while monitoring for follow-on activity such as data leaks or ransomware deployment.

Confirmed and still uncertain

Observed

Known: a public listing by "razq" offering Tekpak dashboard credentials for $300 has been reported by DarkWebInformer, and the listing describes the target as a U.S. industrial manufacturing and automation company.

Alleged

Unknown: whether the access is real, whether the employee account is genuinely compromised, whether multi-factor authentication was actually disabled, and whether the claimed 347,000 records exist or are accessible. DarkWebInformer explicitly states the claim is currently unverified.

What people are saying

Observed

DarkWebInformer, the threat-intelligence account that surfaced the listing, framed it as an "Initial Access" offer and emphasized that the claim is currently unverified.

Observed

No statements from Tekpak Inc., the seller "razq" beyond the listing itself, or independent researchers are present in the current evidence batch.

Evolution

Observed

The evidence batch contains a single report documenting the listing's appearance. No follow-up posts, takedown notices, buyer activity, or victim confirmation are present.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The alleged access targets a GoCanvas Enterprise dashboard, reached through a compromised employee account. The listing states that multi-factor authentication was reportedly disabled on that account.

Alleged

The dataset claimed in the listing comprises 347,000 internal records dating back to 2014, including supply chain logistics data, quality control evaluations, and operational reports. No technical proof-of-access samples or database schemas are included in the report.

Sources and evidence

Observed

This report is based on a single untrusted source: a post by "DarkWebInformer" on X (canonical URL: https://x.com/DarkWebInformer/status/2119805050432167946), which summarizes the underground listing.

Contested

The source itself flags the claim as unverified, and no primary evidence: such as dashboard screenshots, record samples, or corroboration from Tekpak: accompanies the listing. All factual assertions about the breach should be treated as allegations pending independent confirmation.