Brinztech Alert: Database of IT Provider Emcan Information Technology Leaked

Dark Web News Analysis: Emcan Information Technology Database Leak

A database from Emcan Information Technology, an IT company with operations in Bahrain and Saudi Arabia, has been leaked on a hacker forum. The leak consists of two datasets containing over 8,500 rows combined.

The compromised data includes sensitive client information, creating a significant risk for the businesses that use Emcan’s services. The leak reportedly contains:

• Client IDs and full names
• Client email addresses and phone numbers
• Passwords

The structure of the leaked data suggests that a potential SQL Injection vulnerability may have been the root cause of the breach.

Key Cybersecurity Insights

A breach at a B2B IT service provider is particularly dangerous as it creates a ripple effect across all of its clients. The key implications include:

• A Critical Supply Chain Risk: This is the most severe threat. The leaked list of clients and their credentials can be used to launch highly credible attacks against Emcan’s customers. Attackers can impersonate Emcan support staff, using real client data to build trust and trick employees into granting remote access to their systems, revealing more sensitive credentials, or approving fraudulent invoices.
• High Risk of Credential Stuffing and Account Takeover: The exposure of client emails and passwords (even if hashed) poses an immediate risk. Many business users reuse passwords across different corporate platforms. Attackers will use this list in automated attacks to attempt to log in to other services used by the affected clients (like Microsoft 365, VPNs, or other cloud platforms), potentially leading to a much broader compromise.
• SQL Injection Indicates Foundational Security Flaws: The likelihood that this breach was caused by an SQL Injection (SQLi) vulnerability points to fundamental flaws in the company’s web application security. SQLi is a well-understood and entirely preventable vulnerability, and its presence often suggests that other basic security weaknesses may also exist.
• Regional Regulatory Implications: As a company operating in Bahrain and Saudi Arabia, Emcan is subject to the data protection laws of both nations (e.g., Bahrain’s PDPL, Saudi Arabia’s PDPL). A breach of client PII will trigger regulatory investigations and could result in significant fines and reputational damage in the Gulf region.

Critical Mitigation Strategies

An urgent response is required from both the IT provider and its client base.

• For Emcan Technology: Immediate Investigation and Vulnerability Remediation: Emcan must immediately launch a forensic investigation to confirm the breach and identify the root cause, with a primary focus on finding and patching the likely SQL Injection vulnerability in their applications.
• For Emcan Technology: Invalidate Credentials and Notify All Clients: The company must force a password reset for all affected clients. A clear, transparent, and urgent notification must be sent to their entire client base, warning them of the breach and the high risk of targeted phishing and social engineering attacks where attackers may pose as Emcan support.
• For Emcan’s Clients: Proactive Defense is Crucial: Clients of Emcan Information Technology must assume they are being actively targeted. They should immediately change any password that might have been shared with or used for Emcan’s services. All employees should be warned to be extremely skeptical of any unsolicited communications claiming to be from Emcan support and verify all requests through a trusted, out-of-band channel.
• For Emcan’s Clients: Enforce MFA on Your Critical Services: This incident is a powerful reminder for Emcan’s clients to ensure their own critical services (email, VPN, cloud platforms) are protected with Multi-Factor Authentication (MFA). This will protect their business from an account takeover, even if one of their employee’s passwords was compromised in this third-party leak.

Secure Your Organization with Brinztech As a cybersecurity provider, we can protect your business from the threats discussed here. Contact us to learn more about our services.

Questions or Feedback? For expert advice, use our ‘Ask an Analyst’ feature. For general inquiries or to report this post, please email us: contact@brinztech.com