The DeadLock ransomware group has listed Kadick Integrated Limited as a claimed victim, according to threat intelligence trackers. The claim, dated 8 November 2026, was reported by the Ransomware.live tracker and published in a threat briefing on 9 November.

Kadick Integrated Limited is a Nigerian company working in agency banking, IT solutions, airtime distribution, procurement and financial services. The report does not confirm the current status of the company's systems, and no ransom demand has been disclosed.

The incident has been linked to infostealer activity detected by HudsonRock. The report records no compromised employees or users, but it identifies one instance of third-party employee credentials being compromised. An exposure report by ParanoidLab identified 97 passwords, including four classed as critical, although no cookies were reported as compromised. No technical method of entry has been given beyond the association with infostealer activity.

It is important to be clear about what is and is not established. A listing on a ransomware group's leak site is a claim made by the criminals themselves. It does not by itself confirm that an attack took place, that systems were encrypted, or that data was stolen. Neither the company nor any authority has publicly confirmed a breach at the time of writing.

Kadick is one of several DeadLock listings recorded on 8 November. Threat trackers also recorded Fidex in Mexico, NoseTea and Trinity Custom Homes in the United States, Coopebis in Costa Rica and Chonlatee in Thailand on the same day. Across November so far, trackers have recorded 275 ransomware victims claimed on leak sites up to 9 November, with DeadLock accounting for six of them. 8 November was the quietest day of the month so far, with 17 victims recorded.

The case underlines a familiar route into corporate networks. Infostealer malware harvests passwords and session data from infected machines, and those stolen credentials can later give ransomware operators a way in, even when the victim's own staff accounts show no sign of compromise. Third-party credentials are part of the same risk: access granted to a contractor or partner can become an attacker's entry point if it is exposed.

Defenders are advised to audit and reset third-party and employee credentials linked to an affected organisation, to watch for unusual login attempts, and to enforce multi-factor authentication across systems while limiting third-party access to what is strictly necessary. A written credential management policy, with regular scans for exposed passwords and infostealer-related threats, is part of the same defence.