33GB of Internal Data Leaked from Simplex Infrastructures

Data Breach Summary

A major data breach has compromised Simplex Infrastructures Ltd., a leading construction and engineering firm based in India. The breach was executed by a threat actor identified as 0xCAFE, who claimed access to the company’s internal mail server and backup infrastructure. A total of approximately 33GB of sensitive internal data has been leaked, following failed ransom negotiations.

The breach occurred in July 2025, targeting backup and mail servers. The leaked files include complete database backups, server credential dumps, and email system data—posing significant cybersecurity and privacy concerns for both the organization and its clients.

---

What Was Leaked?

The leaked dataset includes:

• dbbkp05072025.7z – An archive (approx. 33GiB decompressed) containing two IBM Db2 9.7 database backup files from Simplex’s backup server. The contents remain largely unexplored due to the proprietary format.

• names.nsf.csv-shadow.7z – Contains a dump of the mail server web interface and Linux system credentials:

  • 649 email credentials including full names, usernames, and hashed passwords
  • /etc/shadow dump exposing server login data

These files were published on a known dark web forum and appear to be authentic based on structure and content samples.

---

Where Was It Found?

The leak was disclosed by 0xCAFE on the dark web forum Darkforums.st, where the actor stated that encrypted server backups and mail data were compromised and released after ransom demands were ignored.

Company Breach History

There are no publicly documented previous breaches involving Simplex Infrastructures Ltd. This breach, however, reveals significant gaps in server security, particularly in mail infrastructure and backup protection—critical points for any enterprise handling large volumes of internal and client data.

---

Recommendations for Affected Users

Users affiliated with Simplex Infrastructures (employees, vendors, partners) should immediately:

• Reset any corporate email or server access credentials
• Enable multi-factor authentication wherever available
• Be alert for phishing emails or suspicious login attempts
• Use unique and strong passwords across different services
• Avoid clicking unknown links or downloading attachments from unknown sources

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.