Ransomware operation CRPxO added pharmaceutical and medical technology giant Johnson & Johnson and Turkish retail chain A101 to its dark-web leak site late on July 31, 2026, according to a ThreatMon threat-intelligence alert circulated the same day. The leak-site entries carry timestamps of 2026-08-01 02:51:24 UTC+3 for Johnson & Johnson and 02:50:24 UTC+3 for A101. A parallel report on the same ThreatMon monitoring cycle records a third entry, FINANSBANK (now trading as QNB Türkiye), timestamped 02:52:01 UTC+3. Neither Johnson & Johnson, A101 nor QNB Türkiye has issued a statement, and no regulator filing or national CERT advisory corroborates the claims. As of publication these are threat-actor assertions, not verified breaches.
What Happened
All three listings originate from the same monitoring window and were posted within roughly 90 seconds of each other, a pattern consistent with batch publication rather than three independent intrusions surfacing by coincidence. UNDERCODE NEWS covered the batch across two write-ups, one pairing Johnson & Johnson with A101 and one pairing FINANSBANK with A101, which is why the incident circulated under two different headline framings. Read together, the batch is three named victims, not two separate events.
The accounts do not conflict on substance, but they do differ in emphasis, and both explicitly caution that a leak-site listing is not proof of successful compromise. Ransomware crews routinely list organisations based on data obtained from a third-party supplier, a reseller, an acquired subsidiary, or in some cases on fabricated or recycled material intended to pressure a target into negotiating.
The FINANSBANK entry carries its own naming problem. Per QNB's own corporate history, Finansbank was founded in 1987, was acquired by Qatar National Bank Group in 2016, operated as QNB Finansbank, and rebranded to QNB Türkiye in October 2024. A leak-site entry using a brand retired nearly two years ago may indicate stale data, an older data set being re-monetised, or simply an operator working from outdated victim-enrichment sources.
What Was Taken
CRPxO has published no sample data, no file trees and no volume claims for any of the three organisations that appear in the available reporting. There is currently no basis to state what, if anything, was exfiltrated from Johnson & Johnson or A101.
What can be documented is Johnson & Johnson's separately disclosed exposure history, which is a matter of public record and unrelated to CRPxO. Security researcher Eaton (Eaton Works) disclosed two web application flaws in 2025 and 2026:
- Campus Recruiting platform. Student personally identifiable information plus interviewer ratings and confidential notes. Source accounts consistently describe "nearly 1,000 students" affected (viralpique, OJO, ictsec.pl). This flaw is tracked as CVE-2026-57912, categorised under CWE-602, Client-Side Enforcement of Server-Side Security, affecting all builds before 2025-10-31, exploitable by an unauthenticated remote attacker with no user interaction.
- Audit Tracking Management System (ATMS). An unauthenticated
getAllUsersendpoint returned a full employee roster including WWIDs. Figures differ slightly by outlet: OJO reports a precise 13,627 records, while ictsec.pl reports "approximately 13,600." Both derive from the same Eaton disclosure. Eaton went on to obtain full administrative access spanning roughly 20 J&J portfolio companies, named in reporting as including LifeScan, Ethicon, Janssen and Biosense Webster.
None of this data is attributed to CRPxO. It is relevant only as context on the size of J&J's exposed application surface if an extortion crew were hunting for a foothold.
Why It Matters
Johnson & Johnson would be, by a wide margin, the largest name CRPxO has claimed. Prior tracked victimology skewed to mid-market healthcare, professional services and technology firms: Security Arsenal's July 27 detection brief names American Hospice & Home Health Services, Leah Walker Orthodontics and Schorr Law from a 20-victim posting batch. A pharmaceutical multinational, a national retail chain and a major bank in a single 90-second batch is a step change in claimed target class, and a step change in the plausibility bar those claims have to clear.
The Turkish concentration also matters. Security Arsenal assessed CRPxO's geography as heavily United States focused with a single Irish outlier. Two Turkish organisations named minutes apart suggests either a genuine regional pivot, a shared supplier or managed service provider between A101 and the bank, or a single access broker selling a bundle of Turkish network access into the affiliate programme.
For defenders, the practical takeaway is that unconfirmed leak-site listings still carry operational cost. They trigger board questions, customer enquiries, supplier questionnaires and regulator interest whether or not a breach occurred. Having a pre-agreed process for responding to an unverified listing is now part of incident readiness.
The Attack Technique
There is no attribution of an initial access vector for the Johnson & Johnson or A101 listings. The two available profiles of CRPxO also describe materially different tradecraft, and that divergence should be stated rather than smoothed over.
Security Arsenal characterises CRPxO as a Ransomware-as-a-Service operation with a strong preference for vulnerability-driven initial access against edge security infrastructure and remote management tooling, correlating its victimology with CISA KEV entries including CVE-2026-50751 (Check Point Security Gateway, IKEv1 authentication bypass) and CVE-2026-20131 (Cisco Secure Firewall Management Center, deserialization leading to remote code execution). It estimates dwell time at three to five days from breach to detonation, often using valid credentials harvested after exploitation, with ransom demands scaling by revenue from around $500,000 into the multi-millions, and it reads the 20-victim batch as evidence of an automated discovery and exploitation pipeline.
FemtoSec's July 11 profile describes a different shape: a cross-platform Windows and macOS payload combining a clipboard hijacker, a crypto wallet seed harvester and an AES encrypter, with initial access resting heavily on social engineering via deceptive archive files, and an affiliate recruitment drive offering access brokers a 70 percent payout split.
These are reconcilable if CRPxO is an affiliate model where access method varies by affiliate, which the 70 percent broker split would support. They are not, however, a single confirmed intrusion chain, and no source ties either technique to the July 31 listings. Treat both as candidate hypotheses.
What Organizations Should Do
- Patch the KEV-listed edge devices first. Prioritise CVE-2026-50751 on Check Point Security Gateways and CVE-2026-20131 on Cisco Secure Firewall Management Center. Both are internet-facing management and VPN surfaces, and both appear in the vector correlation for this group.
- Audit for client-side-only authentication. The J&J flaws share one root cause: MSAL or SSO enforced in the browser while backend APIs accepted hardcoded keys or no credential at all. Enumerate every API your single-page applications call and confirm each validates a token server side. CWE-602 is cheap to find and cheap to exploit.
- Test the pre-redirect window. In both J&J cases the React bundle exposed endpoints before the SSO redirect fired. Include "what does the app hand an unauthenticated visitor in the first 200 milliseconds" in your web application test plan.
- Fix on a clock, not on escalation. Reporting indicates Eaton disclosed privately in October 2025, the recruiting platform was remediated within about 25 days, and the audit system remained exposed until press involvement in April 2026. A researcher-facing SLA with published timelines prevents a fixable flaw from ageing for months.
- Hunt for the three to five day dwell window. Alert on new valid-credential logins from VPN concentrator ranges, mass credential use across subsidiaries, and volume egress from file shares. If Security Arsenal's estimate holds, detection has a narrow window before encryption.
- Prepare an unverified-listing playbook. Decide in advance who validates a leak-site claim, who briefs the board, what you say to customers and regulators before the claim is proven, and how you evaluate any sample data the group later posts. A101, J&J and QNB Türkiye all need this now regardless of whether the claims hold up.
Sources: CRPxO Claims Johnson & Johnson and A101 as New Ransomware Victims —... | CVE-2026-57912: J&J Campus Recruiting Disclosure Flaw | CRPXO Ransomware: Cross-Sector Surge & Firewall Exploitation — Dete... | Exploiting vulnerabilities in Johnson & Johnson web apps - viralpiq... | J&J Left 13.6k Employee Records Accessible Via Unauthenticated APIs... | Someone Hacked Johnson & Johnson's Internal Systems to Teach It a L... | CRPxO Ransomware Group Claims FINANSBANK and A101 as New Victims in... | CRPxO Ransomware Recruits Affiliates for Extortion