- A hacker has shared the corporate credentials of Lenovo for $2,000 on a dark web forum, describing the package contains access to authentication, SSO, education, and employee platforms containing corporate email addresses with hashed or plaintext passwords.
- Corporate credential hacking is one of the major factors responsible for cybercrimes, as more than 4.3 million computers suffered a compromise with infostealer viruses two years ago, while close to 40% of such compromises led to the exposure of highly sensitive corporate system credentials.
- If the claims are true, the hacked credentials could be a means to compromise the account and access the internal systems of Lenovo.
A threat actor recently posted an advertisement on an underground forum offering Lenovo corporate credentials for sale. The criminal claims that the dataset comprises logins and passwords across various Lenovo-related services.
The entire login and password information is available for a price of $2,000. Also, the ad suggests that the offered credentials have links with email addresses, with some information disclosed and some hidden.
Sample entries reportedly reference Lenovo authentication systems, Single Sign-On portals, education platforms, and employee access points. The seller is offering additional samples to interested buyers through an encrypted messaging platform.
According to cybersecurity experts, theft of corporate credentials is the foundation of the cybercrime economy. Working corporate credentials help criminals break through security mechanisms to access sensitive internal resources.
The Growing Threat of Credential Theft
Infostealer malware and the subsequent theft of corporate credentials are fundamental to the modern cybercriminal world. KELA observed over 4.3 million machines infected globally by infostealer malware in two years, accounting for more than 330 million compromised credentials.
Nearly 40% of infected machines included credentials for sensitive corporate systems such as email, Active Directory, and remote desktop access. Employee data is a prime target, a hacker has claimed to be selling an alleged employee database from Shree Transport.
Hudson Rock data shows that the lenovo.com.cn domain has experienced a significant credential compromise. The company has 2,112 total compromised records, 2 belonging to employees and 2,110 attributed to users.
Exposed login portals for both users and employees suggest potential for unauthorized access to sensitive user data. Moreover, attackers could use this information to launch different attacks – including credential stuffing, phishing attacks, or direct corporate credential theft.
Credentials vary significantly in their value to attackers. Hackers can exploit the mailbox of a CEO to conduct targeted phishing campaigns. Also, stolen VPN credentials of an IT employee could allow attackers to spread through the network of a company and deploy ransomware or steal data.
Additionally, automated markets like the Russian Market have emerged to facilitate instant queries and purchases of stolen credentials. Buyers can filter searches by email domains, services, or geographic location, then instantly acquire matching results.
Risks of Corporate Credential Exposure
If the advertised Lenovo credential actually exists, the organization will face huge risks. Exposed employee credentials allow attackers to break into accounts, navigate over the networks of the organization, and access internal systems. Also, hackers can make legitimate use of corporate accounts to evade some of the security layers that depend on identifying unauthorized access.
Cybercriminals often sell network access to specialized actors who then deploy ransomware. These sales of compromised network access affect organizations in all industries and geographies. Technology and telecommunications companies are among the most common victims and often command higher prices on underground markets.
Hudson Rock noted that attackers have built verified databases of working credentials for some of the largest enterprises globally. The exposure of login portals for both users and employees creates risks such as credential stuffing, phishing attacks, or direct corporate credential theft.
Without the presence of exposed sensitive applications, it may be somewhat possible to mitigate the immediate risk. But the current authentication pathways need careful monitoring.
Previous Lenovo Security Incidents and Best Practices
The alleged credential sale follows other recent security incidents involving Lenovo. In June this year, researchers identified a massive incident involving the attack of Fortinet firewall hosts. This incident enabled hackers to access many companies including Oracle, Chevron, and Lenovo.
Almost 74,000 devices from over 21,000 IP Addresses were compromised, with plaintext data of credentials leaked online. In many cases, after compromising the systems, hackers gained access to the central authentication systems of the affected companies.
Lenovo maintains a Product Security Incident Response Team that handles all reports on vulnerabilities through [email protected]. The company acknowledges receipt of all submitted reports within two business days.
Also, Lenovo regularly updates its products to address security issues. For instance, Lenovo Smart Connect for Windows recently patched a vulnerability that could allow local authenticated users to access files belonging to other users. CVE-2026-0421 affected certain ThinkPad models where Secure Boot could be disabled even when configured as ‘On’ in the BIOS setup menu.
Experts highlight the importance of organizations taking measures to protect themselves against credential abuse. They also recommend the application of multi-factor authentication across all systems to provide additional security.
Further, a practice is to change passwords as soon as organizations realize, or suspect, the possibility of a compromise. Effective access administration and up-to-date antivirus programs can prevent invasions. Employees need to receive training in recognizing phishing or other types of social engineering.
The authenticity of the advertised Lenovo credentials remains unverified. Consequently, organizations should remain vigilant and investigate any exposed accounts promptly.
