Dozens of Major Data Breaches Linked to Single Threat Actor

The SecurityWeek report, published on 6 January 2026, ties dozens of major data breaches to a single threat actor operating under the moniker Zestix, also linked to the online persona Sentap, according to Hudson Rock. The actor is described as an initial access broker (IAB) who exfiltrates data and sells it on hacker forums after compromising organisations via stolen credentials from information stealers such as RedLine, Lumma, and Vidar.

Hudson Rock notes that breaches have affected enterprises across sectors including aerospace, government infrastructure, legal, and robotics, with credentials harvested from employees’ devices and used to access file-transfer services like ShareFile, OwnCloud, and Nextcloud where MFA protections were absent. The group has claimed massive breaches at Pan-Pacific Mechanical (1.04 TB), Bradley R. Tyer & Associates (1.02 TB), The Providence Group (1 TB), Australian NBN (306 GB), UrbanX[.]io (275 GB), among others.

Exfiltrated data is sold on closed Russian-language forums, and Zestix has also been seen selling access to compromised systems, according to the piece.