Skip to content

Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed

Changed conditions

Evidence register as of 2026-11-02 21:25 UTC

Credit positions that lenders last valued under one set of cyber conditions, and what has changed since. Each finding is a reason to ask a question. None is a claim that a borrower cannot pay.

Immediate review warranted
1
Material diligence question
1
Monitor for further evidence
1
Context only
1
Insufficient evidence
0
Immediate review warranted

ConnectWise, LLC

A confirmed compromise whose containment is not confirmed, disclosed after the last valuation, on a credit the lenders were already marking down.

$187.2M
BDC fair value, 14 BDC funds holding directly
plus $20.1M held by 2 funds through joint ventures
Next maturity 2028-09-01
T0 · What was known then

Lenders last valued the position at 2026-06-30. Marked down from 101% (2025-06-30) to 92% (2026-06-30), before the incident.

Loan origination dates are not disclosed in these schedules.

Lender marks, % of cost (dashed line is par). Red line: incident disclosed 2026-10-16.
T1 · What changed

Confirmed operational disruption, beginning 2026-10-15, publicly disclosed 2026-10-16. Disclosure came after the lenders' last valuation, so no mark reflects it yet.

Marks dated 2026-09-30, not yet in DFX data, also predate the incident. The first marks that can reflect it are dated 2026-12-31. This is a statement about dates, not a claim that any lender will mark the loan down.

Exposure: Directly affected

The incident record and its sources
T2 · What to investigate now
  • How many of the borrower's own customers (managed service providers) have reported unauthorized access, and has any terminated or paused a contract?
  • What remediation, credit or indemnity costs has ConnectWise committed to customers, and how are they funded?
  • Has Microsoft or any customer raised a contractual or regulatory claim tied to the consented applications?
  • The marks fell from about 100% to 92% of cost between September 2025 and June 2026, before the incident: what drove that, and does the incident change the lender's view of it?

Assessed 2026-11-03

Material diligence question

Chainalysis, Inc

A confirmed compromise at the borrower itself, disclosed after the lenders' last valuation.

$38.7M
BDC fair value, 1 BDC fund holding directly
Next maturity 2029-06-01
T0 · What was known then

Lenders last valued the position at 2026-06-30. Marked near cost (102%) at 2026-06-30.

Loan origination dates are not disclosed in these schedules.

Lender marks, % of cost (dashed line is par). Red line: incident disclosed 2026-10-30.
T1 · What changed

Confirmed compromise, publicly disclosed 2026-10-30. Disclosure came after the lenders' last valuation, so no mark reflects it yet.

Exposure: Directly affected

The incident record and its sources
T2 · What to investigate now
  • Which customer records were accessed, and has any government or enterprise customer suspended use?
  • Does the incident affect renewals in the period before the loan's maturity?
  • Has the borrower notified lenders of the incident under its reporting covenants, and when?
  • What operating or revenue impact has management measured since the incident, and over what period?

Assessed 2026-11-03

Monitor for further evidence

Marathon Health, LLC

A contained incident with no confirmed operational effect yet.

$184.8M
BDC fair value, 1 BDC fund holding directly
Next maturity 2029-02-01
T0 · What was known then

Lenders last valued the position at 2026-06-30. Marked near cost (99%) at 2026-06-30.

Loan origination dates are not disclosed in these schedules.

Lender marks, % of cost (dashed line is par). Red line: incident disclosed 2026-10-29.
T1 · What changed

Confirmed compromise, beginning 2026-08-24, publicly disclosed 2026-10-29. Disclosure came after the lenders' last valuation, so no mark reflects it yet.

The first marks that can reflect it are dated 2026-09-30. This is a statement about dates, not a claim that any lender will mark the loan down.

Exposure: Directly affected

The incident record and its sources
T2 · What to investigate now
  • How many employer clients and patients were notified, and has any employer client re-tendered its contract?
  • Are notification, credit monitoring and legal costs covered by insurance?
  • Has the borrower notified lenders of the incident under its reporting covenants, and when?
  • What operating or revenue impact has management measured since the incident, and over what period?

Assessed 2026-11-03

Context only

Del Monte Foods Corp II Inc

The credit was already impaired before the incident; the incident is context for an existing workout, not the change that should drive a review.

$680K
BDC fair value, 1 BDC fund holding directly
Earliest maturity 2026-09-30 has passed
T0 · What was known then

Lenders last valued the position at 2026-06-30. On non-accrual at 2026-06-30, before the incident.

Loan origination dates are not disclosed in these schedules.

Lender marks, % of cost (dashed line is par). Red line: incident disclosed 2026-10-29.
T1 · What changed

Confirmed compromise, beginning 2026-02-07, publicly disclosed 2026-10-29. Disclosure came after the lenders' last valuation, so no mark reflects it yet.

Exposure: Directly affected

The incident record and its sources
T2 · What to investigate now
  • Is the incident material to recoveries in the existing restructuring, or only to operations?
  • Has the borrower notified lenders of the incident under its reporting covenants, and when?
  • What operating or revenue impact has management measured since the incident, and over what period?
  • Do the borrower's cyber insurance limits and retention cover the costs disclosed so far?

Assessed 2026-11-03

Run this against your own book

A Cyber-Triggered Credit Review covers one borrower: its baseline, what changed, the evidence chain and the questions to put to management. A Portfolio Credit Exposure Audit runs every position you hold.

Request a credit review

Where we could not connect a cyber change to a financial position

We report coverage gaps rather than fill them with weak associations. A technology a company may use, or a business relationship it has, is not an exposure until the relationship is verified.

  • Refrigeration controllers (European and French supermarket attacks)

    The affected sites are named retailers, and the controller software vendor is named for Belgium only. None of the named retailers or the vendor appears as a borrower in DFX's BDC tape, and no lender to a U.S. operator of the same controllers is established.

    Next: Match U.S. grocery and cold-storage borrowers to verified controller vendors; do not assume shared models.

  • PHP and legacy web infrastructure

    DFX holds no lawful, current, version-level observation of borrower web stacks, and inferring one would need scanning, which this product does not do. A generic PHP association is not a finding.

    Next: Use only disclosed incidents or licensed technographic data with observation dates.

  • Binance and digital asset dependencies

    DFX shows one listed investor in Binance and no lender. No borrower in the BDC tape has a verified custody, treasury or operating dependency on Binance. A business association is not an exposure.

    Next: Look for disclosed treasury or custody relationships in BDC portfolio crypto companies' filings.

  • Abrigo and community bank lending workflows

    The outage is confirmed and its cause is not established. Abrigo is owned by Accel-KKR and Carlyle (DFX and Abrigo's own investor page). No bank has publicly said the outage affected it, and product users are not affected parties.

    Next: Monitor for an Abrigo statement on cause and for any bank disclosure naming the outage.