Unverified Dark Web Claim Alleges XTIUM Breach with Massive Data Exfiltration In April 2026, threat actor "The_Auditors" posted on a dark web forum alleging a breach of XTIUM, a managed services provider specializing in security, cloud, network, and unified communications. The claim, which remains unverified, suggests prolonged unauthorized access to XTIUM’s systems, resulting in the exfiltration of 480TB of virtual machine backups tied to client environments and an additional 5.8TB of internal and client data from Synology ShareSync systems. According to the actor, access was maintained for eight months via a compromised Veeam backup environment, with a second intrusion occurring ten days after initial contact with XTIUM. The actor claims the data is being sold and that affected parties are being targeted for extortion. However, no independent validation has confirmed these assertions. Evidence provided by the threat actor includes screenshots of an alleged XTIUM portal, file directory structures, and a purported conversation with an administrator. While these materials support the claim, their authenticity, timing, and uniqueness to XTIUM have not been verified through public sources. Open-source intelligence (OSINT) findings reveal no public confirmation from XTIUM or third-party sources. The company’s status page remained operational during the alleged breach period, with no incident advisories or breach notifications posted. While XTIUM’s public materials reference Veeam partnerships and managed backup services aligning with the actor’s technical claims this context alone does not substantiate a compromise. If verified, the breach could have significant downstream implications, as managed service providers like XTIUM often maintain access to client backups, cloud environments, and shared operational tools. However, at this stage, the claim remains unconfirmed, with no validated sample data, forensic evidence, or regulatory disclosures supporting the actor’s allegations. Monitoring efforts continue for verifiable evidence, including official statements from XTIUM, corroboration from affected clients, or further activity in underground markets. The incident remains an unverified allegation pending additional confirmation.

The Maine Office of the Attorney General reported that Evolve IP, LLC experienced an external system breach (hacking) discovered on October 25, 2024, potentially affecting approximately 344 individuals, including one Maine resident. The breach occurred on September 11, 2024, and a written notification was provided on November 21, 2024, which included identity theft protection services for twelve months through Kroll.