Vect Ransomware and TeamPCP Claim Sportradar Supply-Chain Breach

Summary

A dark-web forum broker acting for Vect Ransomware and TeamPCP claims they stole Sportradar data via a Trivy supply-chain attack, including personal records, athlete profiles, credentials and cloud secrets, offered for up to $50,000.

Key points

A forum broker acting for Vect Ransomware and TeamPCP alleges the attack occurred on March 25, 2026, through a supply-chain attack exploiting Trivy.
The actors claim to have exfiltrated about 28,829 records, including roughly 26,000 PII entries and 23,169 athlete profiles.
The alleged data includes credentials and access tokens linked to FIBA and Bet365, as well as production database passwords, Auth0 and Kafka secrets, and more than 300 API keys.
The claim also lists business contacts, email addresses, and Terraform and AWS configuration data.
The data package is reportedly offered for sale for up to $50,000; the article provides no independent confirmation of the breach or the claimed data.

Article Details

Victim: Sportradar AG
Attack Date: 2026-03-25
Encryption Status: Unknown; the source does not report whether data was encrypted.
Exfiltration Status: Alleged by Vect Ransomware and TeamPCP; not independently confirmed in the source.
Exfiltrated Data: The groups allegedly exfiltrated corporate and client data, including PII, athlete profiles, third-party credentials and access tokens, database passwords, OAuth secrets, Kafka credentials, API keys, and Terraform/AWS configuration files. These claims are unverified in the source.
Exfiltrated Size: The groups allege approximately 28,829 records, including roughly 26,000 PII entries and 23,169 athlete profiles.
Leak Status: The allegedly stolen data is reported to be offered for sale on a dark web forum for up to $50,000 USD; the source does not confirm a public leak or sale.

Threat Actors

TeamPCPNamed by the source as a group claiming to have breached Sportradar AG and exfiltrated data; the claim is not independently confirmed.Vect ransomwareNamed by the source as a group claiming to have breached Sportradar AG and exfiltrated data; the claim is not independently confirmed.

Tools

TrivyThreat groups Vect Ransomware and TeamPCP claim they breached Sportradar AG on March 25, 2026 via a supply-chain attack exploiting Trivy and are selling exfiltrated corporate and client data for up to $50,000 USD.

Industries

Sports data and technologyThe Vect Ransomware and TeamPCP threat groups claim to have compromised Sportradar AG, a multinational sports data and technology company.