Nostr notes by Dark Web Informer :verified_paw:

🚨🇦🇷 Over 903,000 records allegedly leaked from ...

2026-10-16T15:39:50Z

🚨🇦🇷 Over 903,000 records allegedly leaked from Argentina's Municipality of Vicente López

A dataset containing approximately 903,000 records from the Municipality of Vicente López, a local government in Buenos Aires Province, has been released for free.
⠀
The actor "cantpwn" claims to have obtained around 1 GB of information spanning 2015 to 2026.
⠀
The dataset reportedly contains personal information, including:

• Full names, dates of birth, and nationalities
• National identification numbers
• Email addresses and phone numbers
• Residential locations and geographic information
• Marital status and gender
• Registration records and personal preferences
⠀
The post also names Peru as the actor's next target, although no specific organization was identified.
⠀
Claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 Ledger Wallet zero-day exploit advertised for $2,000, claims ...

2026-10-16T15:17:40Z

🚨 Ledger Wallet zero-day exploit advertised for $2,000, claims to steal wallet recovery information

An actor known as "work159" is advertising what they claim is a zero-day exploit targeting the Ledger Wallet desktop application on Windows and macOS.
⠀
The seller claims the exploit can display a fake wallet recovery process directly inside the legitimate application, rather than redirecting victims to an external phishing website.
⠀
According to the listing, the attack requires just one click, with no further user interaction needed.
⠀
The advertised capabilities include:

• Custom phishing overlays displayed inside Ledger Wallet
• Fake wallet recovery screens
• Support for Windows and macOS
• Exfiltration of private keys to a Telegram bot
• Integration into existing Ledger Wallet interface pages
⠀
The seller also claims to provide unobfuscated source code and customizable templates. The asking price has been reduced from $7,500 to $2,000.
⠀
No working demonstration or technical evidence confirming the claimed zero-day vulnerability was included in the visible listing.
⠀
The exploit's existence and capabilities remain unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇺🇸 SCARLETTGROUP claims breach of Genesys Cloud ...

2026-10-16T08:36:38Z

🚨🇺🇸 SCARLETTGROUP claims breach of Genesys Cloud Services, threatens release of internal data

SCARLETTGROUP claims to have breached Genesys Cloud Services, a U.S.-based company providing cloud customer experience and contact center technology.
⠀
The group says it obtained a large collection of internal information, including contracts, signed agreements, customer records, financial documents, and data from the company's CRM systems.
⠀
The alleged breach also extends to Genesys' training and education systems, with the group claiming access to:

• Learner accounts and password hashes
• Training enrollments and certifications
• Single sign-on (SSO) configurations
• Administrative records
• Meeting attendance records and recordings
⠀
SCARLETTGROUP published screenshots purportedly showing access to several internal systems and warned Genesys to make contact before its negotiation deadline expires.
⠀
The group has not disclosed the exact amount of data obtained or when it intends to release the information.
⠀
Claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇳🇱 Ingka Group, the largest IKEA retailer, allegedly ...

2026-10-15T21:19:53Z

🚨🇳🇱 Ingka Group, the largest IKEA retailer, allegedly has 50 GB of GitHub data leaked

An actor known as "0xRune" claims to have obtained approximately 50 GB of data from GitHub repositories belonging to Ingka Group, the company that operates most IKEA stores worldwide.
⠀
The alleged leak covers a wide range of internal projects, including order processing, inventory management, payment systems, customer accounts, and loyalty programs.
⠀
The actor also claims the files contain infrastructure configurations for Google Cloud, Alibaba Cloud, and Cloudflare, alongside Terraform code, CI/CD workflows, and monitoring tools.
⠀
Other repositories reportedly contain AI agents, internal assistants, machine learning pipelines, and automated testing frameworks.
⠀
The listing also references potentially active secrets, although no evidence confirming their validity is visible in the post.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 INTERPOL operation leads to 95 arrests across 17 countries ...

2026-10-15T19:24:00Z

🚨 INTERPOL operation leads to 95 arrests across 17 countries over child sexual abuse material

Authorities executed 127 search warrants during four coordinated operations conducted across Latin America and Europe between March and September 2026.
⠀
The investigations targeted messaging groups used to distribute and sell child sexual abuse material, groom children, coordinate abuse and receive cryptocurrency payments.
⠀
One five-year-old child was rescued in Colombia. Police arrested the child’s parent, who is accused of producing and selling the abusive material online.
⠀
Other findings included:

• More than 4,000 files and 15GB of abusive material discovered in Ecuador
• Administrator of a 700-member distribution group arrested in Panama
• Suspect in Argentina accused of sextorting more than 260 girls across multiple countries
⠀
Approximately 89% of the suspects arrested were male and 11% were female. INTERPOL said the seized material could lead to additional victims and offenders being identified.

Participating countries included Argentina, Bolivia, Brazil, Chile, Colombia, Costa Rica, the Dominican Republic, Ecuador, El Salvador, Guatemala, Honduras, Italy, Panama, Paraguay, Peru, Spain and Uruguay.

Source: https://www.interpol.int/News-and-Events/News/2026/95-arrested-in-operation-targeting-distribution-of-child-sexual-abuse-material

🚨🇺🇸 Cyberattack disrupts the Town of Bernalillo’s ...

2026-10-15T19:15:08Z

🚨🇺🇸 Cyberattack disrupts the Town of Bernalillo’s computer systems and public services

The New Mexico town discovered the attack after its IT director initially investigated what appeared to be a routine internet outage.
⠀
The incident disabled public-facing computer systems, preventing residents from making online water bill payments. Bernalillo’s Motor Vehicle Division office is also closed while recovery work continues.
⠀
Police, fire and other public safety services remain operational. Water service has not been affected, and officials said customers will not face late fees or disconnections during the outage.
⠀
The town contacted the FBI and New Mexico Office of Cybersecurity and hired outside cybersecurity specialists to restore its systems and data.
⠀
Officials have not disclosed whether personal or financial information was accessed, identified the attackers or provided a timeline for restoring online services.

Source: https://www.krqe.com/news/new-mexico/town-of-bernalillo-hit-with-cyberattack/

"Pharoah" has been added to the OpSec Failures page. ...

2026-10-15T18:34:22Z

"Pharoah" has been added to the OpSec Failures page.

Direct file: https://darkwebinformer.com/opsec-failures/#file-pharoah

🚨 Lognet advertises search engine with over 21 billion ...

2026-10-15T17:43:46Z

🚨 Lognet advertises search engine with over 21 billion infostealer records and free daily lookups

IOC: http://lognetbigxp6rritpavbuaq5qz3ni223wjdhw7cm5eav5nppjhbfsbyd[.]onion

A service called Lognet is being promoted as a search engine for stolen credentials and information collected by infostealer malware.
⠀
The operators claim to have indexed more than 21 billion records, allowing users to search by domain, email address, or username. The service is accessible through Tor and offers 15 free searches per day without requiring an email address or credit card.
⠀
Paid subscriptions reportedly provide access to additional information, including:

• Unmasked passwords and device information
• Session cookies
• IP addresses and hardware identifiers
• CSV, JSON, and XLSX exports
• API access for automated searches
⠀
Pricing starts at $5 per month for 525 lookups, with higher tiers offering up to 1,500 searches and unlimited access for business subscribers.
⠀
The service also advertises anonymous cryptocurrency payments and claims that searches return results within milliseconds.
⠀
The size of the dataset and the service's advertised capabilities have not been independently verified.

This is NOT and ad.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇺🇸 Over 518,000 U.S. telecom customer records and live ...

2026-10-15T17:14:36Z

🚨🇺🇸 Over 518,000 U.S. telecom customer records and live network access offered for sale

More than half a million customer records from an unidentified U.S. telecommunications provider are being advertised alongside what the seller claims is active access to the company's network infrastructure.
⠀
The actor "Erich" claims to have obtained 518,357 records containing customer names, residential addresses, phone numbers, account statuses, and service information.
⠀
The more concerning part of the listing is the alleged network access. The seller claims they can remotely rename WiFi routers, disconnect customers, change wireless settings, and potentially disable millions of modems.
⠀
The actor says the access remains functional and is looking for a quick sale. No company name or technical evidence demonstrating control over the network was provided.
⠀
Claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇨🇦 Web shell access to Canadian AI conversational ...

2026-10-15T15:58:05Z

🚨🇨🇦 Web shell access to Canadian AI conversational platform offered for sale

An actor using the handle "Spider777" is advertising web shell access to an unidentified AI-based conversational platform operating in Canada.
⠀
The seller claims the access extends across multiple domains, potentially allowing interaction with several parts of the platform's web infrastructure.
⠀
The listing provides few technical details, with the actor asking interested buyers to make contact privately. No company name, affected domains, or asking price have been disclosed.
⠀
Claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️ New Ransomware Group: 0x00 Dark Web: ...

2026-10-15T15:41:46Z

‼️ New Ransomware Group: 0x00

Dark Web: http://oxooxmnl67z5t5cctt3uw7ukqoy6k7kr6x5vn2yyhcfpbuj5ddq2hjid[.]onion

‼️ New Ransomware Group: The Seven Deadly Sins Dark Web: ...

2026-10-15T15:16:23Z

‼️ New Ransomware Group: The Seven Deadly Sins

Dark Web: http://sinsp6ibw32abbcoagbjwetgm2w56u7tr4izy3xzp7ehqoenxvdd3qyd[.]onion

🚨🇯🇵 Mercari dataset containing 24 million records ...

2026-10-15T15:05:21Z

🚨🇯🇵 Mercari dataset containing 24 million records advertised for sale

A dataset allegedly containing 24 million records from Mercari, one of Japan's largest online marketplaces for buying and selling secondhand goods, is being offered for $400.
⠀
The actor "tet" claims to have obtained customer information, including full names, email addresses, phone numbers, residential addresses, and account details.
⠀
The dataset also contains information about users' buying and selling activity, including completed transactions, cancelled purchases, active listings, and seller earnings.
⠀
Claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 A dataset allegedly taken from Bodyswap.ai has been ...

2026-10-14T23:51:36Z

🚨🇫🇷 A dataset allegedly taken from Bodyswap.ai has been shared online.

The actor "MrData" claims to have hacked the AI photo and video editing platform and leaked around 10,000 records.

It's unclear what information is included, as the post doesn't provide any details or visible samples.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️ An actor claims to share the Scale AI organizations GitHub ...

2026-10-14T23:25:55Z

‼️ An actor claims to share the Scale AI organizations GitHub repository data.

The actor claims the data is described as production and staging source code, including monolithic workspaces, frontend/backend microservices, genAI applications, infrastructure configs, and database schemas.

Claim is unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️ New Dark Web Informer Blog Post! Title: Taiwan Otsuka ...

2026-10-14T23:10:53Z

‼️ New Dark Web Informer Blog Post!

Title: Taiwan Otsuka Pharmaceutical Leak Claim Lists 832 GB of Internal Company Data

Link: https://darkwebinformer.com/taiwan-otsuka-pharmaceutical-leak-claim-lists-832-gb-of-internal-company-data/

💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

🚨🇧🇪 Belgian Hospital Network Access Offered for Sale A ...

2026-10-14T23:00:08Z

🚨🇧🇪 Belgian Hospital Network Access Offered for Sale

A major hospital network in Belgium is the subject of an initial access sale involving internal servers, employee workstations, and email systems.

The actor "chris" claims to have full Remote Desktop Protocol (RDP) access to internal servers and several workstations, along with IMAP/SMTP credentials for the hospital's internal email domain.

The listing also includes OpenVPN configuration files, potentially providing additional routes into the organization's network. The hospital has not been identified.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 Bad ASN List: A curated blocklist of 2,200+ ASNs tied to ...

2026-10-14T22:38:05Z

🚨 Bad ASN List: A curated blocklist of 2,200+ ASNs tied to VPNs, datacenters, hosting providers, scanners, and infrastructure commonly associated with automated abuse.

GitHub: https://github.com/bountyyfi/bad-asn-list

The list is designed to help reduce scraping, credential stuffing, bot traffic, anonymous abuse, and other unwanted activity by identifying suspicious network sources at the ASN level.

Includes categories covering:

• VPN and proxy providers
• Major and budget hosting
• Bulletproof hosting
• Known scanner infrastructure
• DDoS and abuse sources
• Infrastructure linked to ransomware and cybercrime activity

The repo currently contains 2,234 ASNs and includes implementation examples for Cloudflare Workers, Node.js, Flask, iptables, and nftables.

"Lux" has been added to the OpSec Failures page. Direct ...

2026-10-14T20:09:38Z

"Lux" has been added to the OpSec Failures page.

Direct file: https://darkwebinformer.com/opsec-failures/#file-lux

🚨🇺🇸 Brooklyn prosecutors dismantle infrastructure behind ...

2026-10-14T19:42:42Z

🚨🇺🇸 Brooklyn prosecutors dismantle infrastructure behind multinational crypto investment scam targeting Russian speakers

The Brooklyn District Attorney’s Virtual Currency Unit disrupted 241 fraudulent investment domains and 112 cloud servers with assistance from the FBI.
⠀
The three-year investigation traced infrastructure to Ukraine and other parts of Eastern Europe. The operation is estimated to have stolen tens of millions of dollars from victims across the United States, including Brooklyn residents.
⠀
Investigators say victims were targeted through Russian-language Facebook advertisements.

Fake investment advisers then instructed them to:

• Create accounts on fraudulent trading platforms
• Purchase cryptocurrency
• Transfer the funds to wallets controlled by the scheme
⠀
The websites displayed fabricated investment gains. When victims attempted to withdraw their money, their accounts were blocked or they were told to pay additional fees and taxes.
⠀
Investigators also uncovered a secondary recovery scam that contacted previous victims and falsely offered to retrieve their stolen assets.
⠀
Some victims reportedly lost their entire life savings. Authorities have seized approximately $300,000 and are working to recover additional funds.

No arrests or suspects were announced.

Seized domains:

cleartr-division[.]com
quantumia-tech[.]com

Source: https://www.brooklynda.org/2026/10/14/brooklyn-das-virtual-currency-unit-dismantles-infrastructure-of-multinational-crypto-investment-scam-that-targeted-russian-speakers/

🚨🇺🇸 Mississippi man convicted of distributing child ...

2026-10-14T18:43:06Z

🚨🇺🇸 Mississippi man convicted of distributing child sexual abuse material for profit

A federal jury convicted Justin Lee Plunk, 39, of Corinth, Mississippi, of conspiring to distribute and distributing child sexual abuse material through Instagram and Telegram.
⠀
The conspiracy operated from at least 2021 through 2024 and recruited minor girls, including children as young as 10, to create packages of abusive images and videos and participate in live video calls with paying customers.

The operation used Instagram, Snapchat and Telegram. One victim was introduced to the conspiracy through Roblox.
⠀
Customers paid through Cash App, Venmo, Walmart gift cards and Roblox gift cards.

Investigators connected Plunk to more than $57,000 in proceeds received through cash transfers and gift cards.
⠀
Plunk was previously convicted in Mississippi in 2016 of enticing a child for sexual purposes.

He faces up to 40 years in federal prison and is scheduled to be sentenced on January 26, 2027.

Source: https://www.justice.gov/opa/pr/mississippi-man-convicted-federal-jury-participating-criminal-conspiracy-distribute-child

🚨🇲🇰 North Macedonia and FBI dismantle OLVX stolen data ...

2026-10-14T18:30:25Z

🚨🇲🇰 North Macedonia and FBI dismantle OLVX stolen data marketplace

North Macedonia’s Ministry of Interior has filed a criminal complaint against a 20-year-old from Golema Rečica who allegedly administered the OLVX cybercrime marketplace.
⠀
OLVX operated through multiple domains and was used to sell stolen personal data, account credentials, cybercrime tools and services used to attack victim accounts and computer networks.

Authorities say more than 1,500 stolen credentials were offered through the platform.
⠀
The suspect allegedly administered OLVX-related websites between 2023 and 2025. Investigators also linked him to “ONEMILI,” a Telegram group that distributed cybercrime tools and services, including fraudulent refund schemes, during 2025 and 2026.

Police additionally allege that the suspect obtained and possessed child sexual abuse material through Telegram.
⠀
The criminal complaint includes suspected computer fraud, misuse of personal data, and the production and distribution of child sexual abuse material.

The operation was conducted by North Macedonia’s Cybercrime and Digital Forensics Sector using information and assistance provided by the FBI.

Source: https://mvr.gov.mk/en-GB/odnosi-so-javnost/novosti/uspesna-zaednicka-akcija-na-mvr-i-fbi-razbien-nelegalen-onlajn-pazar-za-prodazba-na-ukradeni-podatoci-krivicna-prijava-protiv-20-godisnik-od-tetovsko

⚠️ New T1erOne forum domain: tier1[.]ink Previous domain was ...

2026-10-14T18:00:13Z

⚠️ New T1erOne forum domain:

tier1[.]ink

Previous domain was suspended.

🚨🇺🇸 FBI disrupts more than 40 suspected North Korean ...

2026-10-14T17:44:11Z

🚨🇺🇸 FBI disrupts more than 40 suspected North Korean laptop farms across Texas

Federal agents searched more than 40 residences and seized approximately 187 laptops and remote-control devices allegedly used by North Korean IT workers to obtain jobs at American companies.
⠀
The Justice Department also announced charges against 14 people, including U.S. citizens and Chinese nationals. Two U.S. defendants have been arrested.

The scheme allegedly affected more than 70 companies across healthcare, communications, cybersecurity, retail and manufacturing, generating approximately $3 million for the IT workers.
⠀
North Korean operatives used stolen identities to apply for remote positions while U.S.-based facilitators received company laptops, installed remote-access software and kept the devices online at American residences.

This made overseas workers appear to be legitimate employees working from inside the United States.
⠀
The FBI says North Korean IT workers have also begun subcontracting their jobs to freelancers, extorting employers, threatening former managers and targeting positions involving defense contractors and government security clearances.

Authorities believe much of the revenue was transferred to sanctioned North Korean entities connected to the country’s weapons programs.

Source: https://www.justice.gov/usao-ndoh/pr/14-indicted-north-korean-remote-it-worker-conspiracy-affecting-more-70-us-companies

🚨 PoC published for a critical GitLab CI/CD remote code ...

2026-10-14T17:23:01Z

🚨 PoC published for a critical GitLab CI/CD remote code execution vulnerability; CVE-2026-97229

PoC: https://github.com/jburgess-r7/CVE-2026-97229-PoC

The flaw is caused by an integer overflow in GitLab's regular expression compiler. A crafted CI/CD configuration combined with a specially formed repository path can corrupt Onigmo regex bytecode and ultimately execute operating system commands as the GitLab git user.

CVSS: 10.0 Critical
Affected: GitLab 19.2 < 19.2.8, 19.3 < 19.3.5, and 19.4 < 19.4.2
Fixed: GitLab 19.2.8, 19.3.5, and 19.4.2

The PoC was validated against GitLab CE 19.4.1 on Linux amd64 and demonstrates command execution through the public CI lint endpoint after the required malicious project setup.

🚨 PoC published for a Windows privilege escalation ...

2026-10-14T17:01:42Z

🚨 PoC published for a Windows privilege escalation vulnerability involving the Windows Health and Optimized Experiences service; CVE-2026-85884

PoC: https://github.com/Beardhammer/CVE-2026-85884

The issue allows low-privileged code with access to the Windows diagnostics workflow to trigger a trusted ETW event containing an attacker-controlled Lua module path. The LocalSystem whesvc service can then execute that module through WinDiag without properly validating the producer or restricting the module location.

Affected: Windows 11 x64 builds including 26200.8457 and 29617.1000
Impact: Local privilege escalation to SYSTEM

The PoC demonstrates the full chain from a standard non-administrator PowerShell session to execution as NT AUTHORITY\SYSTEM.

🚨 PoC published for a critical unauthenticated Splunk ...

2026-10-14T16:49:31Z

🚨 PoC published for a critical unauthenticated Splunk Enterprise remote code execution vulnerability; CVE-2026-76268

PoC: https://github.com/murrez/CVE-2026-76268

The flaw affects the Patroni REST API used by the PostgreSQL sidecar on Splunk Enterprise search head cluster members. Critical configuration operations can be accessed without authentication, allowing an attacker with network access to the Patroni service to modify PostgreSQL configuration and execute operating system commands.

CVSS: 9.8 Critical
Affected: Splunk Enterprise 10.2.0 - 10.2.6 and 10.4.0 - 10.4.2
Fixed: Splunk Enterprise 10.2.7 and 10.4.3

The PoC includes vulnerability checking, Patroni port discovery, multi-target scanning, out-of-band verification, and an exploit mode demonstrating the RCE chain.

🚨🇺🇸 Access to a U.S. B2B Payment Processing ...

2026-10-14T16:37:47Z

🚨🇺🇸 Access to a U.S. B2B Payment Processing Company's Systems Offered for Sale

An unidentified U.S. company specializing in business-to-business invoice processing and payments is the subject of an initial access sale.

The actor "Minions" claims to have administrator access, access to the company's production database, and control of a Windows machine hosted on Amazon's cloud infrastructure.

The company's platform processes invoices received in various formats, including PDF, JPG, and paper documents. These invoices are digitized, reviewed through an administrative dashboard, and approved before being forwarded to a payment system.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇺🇸🇪🇺 Actor Seeking VPN, RDP, and SOCKS Access to ...

2026-10-14T16:11:44Z

🚨🇺🇸🇪🇺 Actor Seeking VPN, RDP, and SOCKS Access to U.S. and European Networks

An actor operating under the handle "nirvana" is looking to purchase unauthorized access to corporate networks across North America and Europe.

The listing specifically targets U.S. organizations with a stated threshold of 7 million and companies in Western and Northern Europe with a threshold of 10 million, although the metric is not explicitly defined.

The actor is also offering to collaborate with other initial access brokers, proposing percentage-based profit-sharing arrangements for access provided by third parties.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇺🇸 Oakland man pleads guilty to sex trafficking a minor ...

2026-10-14T16:03:54Z

🚨🇺🇸 Oakland man pleads guilty to sex trafficking a minor he met through Instagram

Keynin McGee, 27, admitted meeting the victim through Instagram in 2021 and communicating with her for several months before purchasing a bus ticket for her to travel and meet him.
⠀
After collecting the victim from the bus station, McGee bought her clothing and took her to a hotel. He then posted photographs of her on a website used to advertise commercial sex.

McGee later drove the victim to areas in Oakland and San Francisco known for commercial sex work and instructed her to solicit buyers in passing vehicles.
⠀
McGee is scheduled to be sentenced on January 19, 2027. He faces a mandatory minimum sentence of 10 years in federal prison.

Source: https://www.justice.gov/opa/pr/california-man-pleads-guilty-sex-trafficking-minor

🚨🇸🇬 iMin Technology Source Code Allegedly Stolen and ...

2026-10-14T15:53:18Z

🚨🇸🇬 iMin Technology Source Code Allegedly Stolen and Leaked

iMin Technology, a Singapore-based company that develops Android point-of-sale (POS) hardware and software solutions for businesses, has been named in a data breach involving its source code.

The actor "888" claims to have compromised the company and obtained proprietary source code.

The listing includes a reference to a file tree as a sample, but provides no details about the affected software components or the amount of source code allegedly stolen.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇮🇶 Exogen Genetics Diagnosis Dataset Containing 19,000 ...

2026-10-14T15:47:39Z

🚨🇮🇶 Exogen Genetics Diagnosis Dataset Containing 19,000 Records Leaked

Exogen Genetics Diagnosis, an Iraqi company providing genetic testing and research services, has been named in a data breach involving approximately 19,000 user records.

The actor "888" claims to have compromised the company and released a dataset containing names, phone numbers, genders, ages, and cities.

The published sample includes personal information belonging to individuals in Erbil, Sulaymaniyah, and other locations across Iraq.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️ New Dark Web Informer Blog Post! Title: Ampath ...

2026-10-14T15:31:55Z

‼️ New Dark Web Informer Blog Post!

Title: Ampath Laboratories Data Breach Claim Says 10 Databases Copied, Including 80M+ Admission Records

Link: https://darkwebinformer.com/ampath-laboratories-data-breach-claim-says-10-databases-copied-including-80m-admission-records/

💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

‼️ New Dark Web Informer Blog Post! Title: Climb Up Customer ...

2026-10-14T15:15:52Z

‼️ New Dark Web Informer Blog Post!

Title: Climb Up Customer Dataset Offered for Sale With 151,000 Records Across 29 French Gyms

Link: https://darkwebinformer.com/climb-up-customer-dataset-offered-for-sale-with-151-000-records-across-29-french-gyms/

💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

🚨🇦🇪 UAE Football Association Allegedly Hit by Massive ...

2026-10-14T14:54:18Z

🚨🇦🇪 UAE Football Association Allegedly Hit by Massive 122 GB Data Leak

The United Arab Emirates Football Association (UAE FA), the governing body responsible for overseeing football in the country, has been named in a major data leak involving millions of records and thousands of sensitive documents.

The actor "Lenken" claims to have obtained approximately 122 GB of information, including 130 million records across more than 500 tables and over 70,000 documents. Around 15 million records are described as significant, while the remainder reportedly consists of logs and voting data.

The exposed information allegedly includes personal details belonging to players, referees, and managers, such as names, phone numbers, email addresses, residential addresses, identity cards, and passports.

The actor also claims to have organized documents belonging to approximately 4,000 professional football players into individual folders, totaling 66 GB, alongside 55 Excel spreadsheets containing structured information.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 Three 17-year-olds arrested for allegedly operating ...

2026-10-14T07:33:21Z

🚨🇫🇷 Three 17-year-olds arrested for allegedly operating a stolen data lookup service

French authorities shut down Reacher and its successor, Stryx, after identifying three teenagers suspected of administering the platforms.
⠀
Created in March 2026 and renamed Stryx in June, the service allowed users to search stolen personal data using information such as:

• Names
• Phone numbers
• Home addresses
• IBANs and bank account details
• Vehicle registration numbers
⠀
The platform reportedly offered free searches alongside paid subscriptions and credits. It claimed to index 730 million lines of data and had processed approximately 3.1 million searches.

France’s Office for Combating Cybercrime arrested the three suspects on October 6. Authorities closed the platforms the following day.
⠀
The teenagers are accused of receiving fraudulently extracted data and possessing or transmitting stolen data as part of an organized group.

They are scheduled to appear before a juvenile court in Paris on January 14, 2027, and could face up to 10 years in prison if convicted.

Ledger has instructed resellers and distributors in Indonesia, ...

2026-10-13T23:23:01Z

Ledger has instructed resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales amid the investigation into tampered devices linked to cryptocurrency theft.

Confirmed incidents remain limited to Southeast Asia, with no evidence that Ledger’s infrastructure, services, or direct sales channel have been compromised.

https://x.com/DarkWebInformer/status/2110149128978379193

🚨🇺🇸 Lindy Communities Dataset Containing 92,000 Personal ...

2026-10-13T22:17:13Z

🚨🇺🇸 Lindy Communities Dataset Containing 92,000 Personal Records Offered for Sale

Lindy Communities, a U.S. real estate and property management company, has been named in a data breach claim involving the personal information of approximately 92,000 individuals.

The actor "Sorb" claims to have obtained a dataset containing 54,000 unique email addresses, 44,000 unique phone numbers, full names, residential addresses, and other personal information.

Approximately 9,000 additional files containing property inspections and assessment reports were also allegedly stolen. Published samples include tenant records, employee information, move-out inspection forms, and photographs documenting property conditions.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️🇺🇸 An actor is offering for sale a dataset allegedly ...

2026-10-13T20:51:32Z

‼️🇺🇸 An actor is offering for sale a dataset allegedly from SiriusXM containing 500,000 lines of email addresses and partial phone numbers for $300.

The actor provides a 10k sample and states the data will be publicly leaked if no buyer is found within 30 days.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️🇺🇸 An actor is offering for sale a dataset allegedly ...

2026-10-13T20:50:32Z

🚨🇰🇵 FBI Warns North Korean IT Workers Are Expanding ...

2026-10-13T20:32:14Z

🚨🇰🇵 FBI Warns North Korean IT Workers Are Expanding Recruitment and Threatening Victims

The FBI has issued a new warning about North Korean IT workers infiltrating Western companies using stolen identities, fake employment records, and paid intermediaries.

The workers are increasingly recruiting Americans to attend job interviews, impersonate applicants, and operate laptop farms that allow North Korean personnel to work remotely while concealing their actual locations.

The FBI says some operations have escalated beyond employment fraud. Workers have reportedly stolen corporate data, extorted employers, and even threatened former managers and their families with physical violence.

According to the agency, an estimated 85% to 90% of the revenue generated by these operations goes to the North Korean government, helping fund its military and nuclear programs.

https://x.com/FBICyberDiv/status/2110105806733504706?s=20/video/1

Source: https://www.ic3.gov/PSA/2026/PSA261013

🚨 PiratProxies Advertises Residential, Mobile, and Datacenter ...

2026-10-13T20:24:56Z

🚨 PiratProxies Advertises Residential, Mobile, and Datacenter Proxies Starting at $0.18/GB

PiratProxies, a proxy service offering residential, mobile, and datacenter IP addresses, is being advertised by the actor "RavenReyes."

The service claims coverage across more than 200 countries, with residential proxies priced at $2.64 per GB, U.S. mobile proxies at $4.20 per GB, and IPv6 datacenter proxies starting at $0.18 per GB.

Additional features include rotating IP addresses, sticky sessions, HTTP and SOCKS5 support, automated provisioning, and city-level targeting. Customers can purchase plans starting at 1 GB, with payments accepted in Bitcoin, USDT, Litecoin, and other cryptocurrencies.

The advertised pricing and service capabilities have not been independently verified and this is NOT an ad.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Dread is currently offline due to another DDoS attack. ...

2026-10-13T20:09:50Z

Dread is currently offline due to another DDoS attack.

The latest DIG AI update: • UI revamped • 2 new text models ...

2026-10-13T19:50:43Z

The latest DIG AI update:

• UI revamped
• 2 new text models
• 3 new image models
• Thinking time decreased

Dark Web: http://digdig2nugjpszzmqe5ep2bk7lqfpdlyrkojsx2j6kzalnrqtwedr3id[.]onion

wamus has released a new DIG AI update: • UI revamped • 2 new ...

2026-10-13T19:49:08Z

wamus has released a new DIG AI update:

• UI revamped
• 2 new text models
• 3 new image models
• Thinking time decreased

Dark Web: http://digdig2nugjpszzmqe5ep2bk7lqfpdlyrkojsx2j6kzalnrqtwedr3id[.]onion

🚨🇫🇷 WeFix Dataset Containing 6,009 Records Leaked WeFix, ...

2026-10-13T19:15:41Z

🚨🇫🇷 WeFix Dataset Containing 6,009 Records Leaked

WeFix, a French company specializing in electronics repair and refurbishment, has been targeted in a data leak involving customer and device repair information.

The actor "Syrv4x" has released a 0.4 MB dataset containing 6,009 records. The information includes customer names, email addresses, phone numbers, residential addresses, device models, IMEI numbers, and repair service details.

The records also contain insurance and warranty claims, repair statuses, appointment information, and shipment tracking details. Two files covering insurance and partner-related service requests have been shared for free.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 Ecologic Dataset Containing 46,467 Records Leaked ...

2026-10-13T19:11:01Z

🚨🇫🇷 Ecologic Dataset Containing 46,467 Records Leaked

Ecologic, a French government-approved nonprofit organization responsible for collecting, recycling, and managing end-of-life electrical and electronic equipment, has been named in a data leak involving 46,467 records.

The actor "Syrv4x" has released a 32 MB dataset containing contact information, business addresses, incident reports, partner details, and internal user account information.

The records also include company registration identifiers, operational details, and information related to waste collection and recycling activities. The dataset is being distributed for free.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 Exploit for a critical Fortinet FortiClient EMS ...

2026-10-13T18:13:18Z

🚨 Exploit for a critical Fortinet FortiClient EMS pre-authentication bypass; CVE-2026-35616

Exploit: https://github.com/Alaatk/CVE-2026-35616

The flaw affects FortiClient EMS and stems from improper access control around client-certificate authentication. An unauthenticated attacker can forge trusted certificate-related HTTP headers and access protected API functionality.

CVSS: 9.8 Critical
Affected: FortiClient EMS 7.4.5 - 7.4.6
Fixed: FortiClient EMS 7.4.7 / vendor hotfix

The exploit discovers usable certificate identities, forges the required authentication headers, tests multiple protected API endpoints, and confirms whether the authentication bypass succeeds.

🚨 PoC released for a Hyperledger FireFly server-side request ...

2026-10-13T18:06:36Z

🚨 PoC released for a Hyperledger FireFly server-side request forgery vulnerability; CVE-2026-82957

PoC: https://github.com/hakaioffsec/CVE-2026-82957

The flaw affects FireFly webhook subscriptions, where a user-controlled webhook URL can be accepted without properly validating the destination host. This can allow the FireFly node to send requests to internal services, private networks, loopback addresses, and cloud metadata endpoints.

CVSS: 8.5 High
Affected: Hyperledger FireFly ≤ 1.5.0

The PoC creates a malicious webhook subscription, triggers a matching event, and verifies that the request originates from the FireFly server itself.

‼️ New Dark Web Informer Blog Post! Title: KFC Venezuela ...

2026-10-13T17:26:26Z

‼️ New Dark Web Informer Blog Post!

Title: KFC Venezuela Dataset Claim Lists 1.54 Million JSON Records in 17.5 GB Archive

Link: https://darkwebinformer.com/kfc-venezuela-dataset-claim-lists-1-54-million-json-records-in-17-5-gb-archive/

💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

🚨🇬🇧 Cyberattack disrupts IT systems at Hobbs, Whistles ...

2026-10-13T17:16:47Z

🚨🇬🇧 Cyberattack disrupts IT systems at Hobbs, Whistles and Phase Eight

The Foschini Group identified a cybersecurity incident at its UK division, TFG London, on October 11.

The incident affected IT systems supporting the Hobbs, Whistles and Phase Eight fashion brands. Several systems remain unavailable, and customers may experience limited website functionality or delays with recent orders.
⠀
Stores remain open and trading. Inside Story and White Stuff were not affected, while TFG’s operations in Africa and Australia use separate systems and are also unaffected.

The company activated its incident response and business continuity plans, brought in external cybersecurity specialists and notified the relevant UK authorities.
⠀
An investigation is underway to determine whether personal or other sensitive information was compromised.

TFG has not identified the attackers or disclosed how its systems were accessed.

Source: https://www4.sharenet.co.za/v3/sens_display.php?scode=&seq=6&tdate=20261013070500

‼️ New Dark Web Informer Blog Post! Title: German ...

2026-10-13T16:46:20Z

‼️ New Dark Web Informer Blog Post!

Title: German Municipality Targeted in Suspected AI-Driven Zero-Day Attack

Link: https://darkwebinformer.com/german-municipality-targeted-in-suspected-ai-driven-zero-day-attack/

💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

‼️ New Dark Web Informer Blog Post! Title: Ivanti Patches ...

2026-10-13T16:13:15Z

‼️ New Dark Web Informer Blog Post!

Title: Ivanti Patches Actively Exploited Connect Secure Zero-Day and Critical Credential-Leak Flaws

Link: https://darkwebinformer.com/ivanti-patches-actively-exploited-connect-secure-zero-day-and-critical-credential-leak-flaws/

💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

🚨🇸🇦 Geidea Payment Gateway Allegedly Compromised Through ...

2026-10-13T15:07:44Z

🚨🇸🇦 Geidea Payment Gateway Allegedly Compromised Through Multiple SQL Injection Vulnerabilities

Geidea, a Saudi Arabian financial technology company providing payment processing and merchant services, has been named in a data breach claim involving its operations across the Middle East.

The actor "bytetobreach" claims to have exploited five SQL injection vulnerabilities to extract information from multiple databases, including transaction records, payment information, merchant details, and user data.

The alleged exposure affects payment operations in Saudi Arabia, Egypt, and the United Arab Emirates. The actor has published several backup links to the claimed stolen information and states that no ransom is being demanded.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️ New Ransomware Group: HYFLOCK ...

2026-10-13T14:56:51Z

‼️ New Ransomware Group: HYFLOCK

http://yhgphvfgaecacgtlbn67u7yfhafe6evnj4gs4s2oyb3hzjnlhq45azqd[.]onion/

‼️ New Dark Web Informer Blog Post! Title: IAD France Dataset ...

2026-10-13T14:52:03Z

‼️ New Dark Web Informer Blog Post!

Title: IAD France Dataset Leak Claim Includes 112,780 Property Records and 8,592 Agent Profiles

Link: https://darkwebinformer.com/iad-france-dataset-leak-claim-includes-112-780-property-records-and-8-592-agent-profiles/

💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

🚨🇦🇺 First State Auctions Customer Dataset Allegedly ...

2026-10-13T14:44:28Z

🚨🇦🇺 First State Auctions Customer Dataset Allegedly Leaked

First State Auctions, an Australian auction business, has been named in a data leak involving customer information.

The actor "sexyskin" claims to have obtained 1,008,376 customer records, including full names, email addresses, phone numbers, residential addresses, cities, and postal codes. The listing's headline advertises 100,000 records, although the body gives a substantially higher figure.

Separately, WhiteIntel has identified 281 credential leak exposures associated with the company's domain, including 276 consumer and 5 corporate exposures. These findings have not been linked to the advertised dataset.

Claim is currently unverified.

Infostealer data via @whiteintel_io (X)

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 MaQuestionMedicale Teleconsultation Dataset ...

2026-10-13T14:29:25Z

🚨🇫🇷 MaQuestionMedicale Teleconsultation Dataset Containing 369,899 Records Offered for Sale

MaQuestionMedicale, a French online medical consultation platform, has been named in a data sale involving nearly 370,000 teleconsultation records.

The actor "Feel" claims to have scraped the information directly through a patient's account. The dataset reportedly contains consultation messages, doctors' responses, file attachments, timestamps, and other medical consultation details.

The seller has published screenshots as proof and is offering the dataset for sale.

Claim is currently unverified.

Infostealer data via @whiteintel_io (X)

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 BruteForceAI: A LLM-powered login testing tool that combines ...

2026-10-12T23:05:04Z

🚨 BruteForceAI: A LLM-powered login testing tool that combines AI form analysis with automated credential attacks

GitHub: https://github.com/MorDavid/BruteForceAI

The tool uses an LLM to analyze login pages and automatically identify the username, password, and submission elements before launching authorized authentication testing.

Features include:

• LLM-powered login form analysis
• Brute-force and password-spray modes
• Multi-threaded execution
• Proxy and User-Agent rotation
• Configurable delays and jitter
• Ollama and Groq support
• SQLite logging
• Discord, Slack, Teams, and Telegram notifications

Designed for penetration testing and authorized security assessments where login workflows need to be identified and tested at scale.

‼️🇺🇸 MyMichigan Health is named in a new ransomware ...

2026-10-12T22:22:28Z

‼️🇺🇸 MyMichigan Health is named in a new ransomware attack by MetaEncryptor ransomware.

🇺🇸 MyMichigan Health - A Michigan-based nonprofit health system providing hospital, urgent care, home health, virtual care, primary care, and specialty medical services across more than 85 specialties.

The listing shows $5.1 billion in revenue, 13,200 employees, and a 21-day deadline. No files have been published yet.

Made some additional changes to the threat feed yesterday and ...

2026-10-12T21:34:16Z

Made some additional changes to the threat feed yesterday and today.

All those emojis that were in the titles should all be gone, except for the past alerts. That is a separate cleanup.

Made some additional scheduling changes to the script which should push the alerts over 2,000 a day now.

🚨 Blacknet00 Recruiting Initial Access Brokers and Cybercrime ...

2026-10-12T20:23:17Z

🚨 Blacknet00 Recruiting Initial Access Brokers and Cybercrime Affiliates

An actor operating under the handle "Blacknet00" is looking to expand its operations by recruiting initial access brokers (IABs), developers, and other technical specialists.

The group claims to already possess the tools needed for network intrusions and system takeovers, including the ability to develop custom tools.

The recruitment effort is focused on individuals and groups experienced in network exploitation, infrastructure development, and security assessments.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇺🇸 Giant Food websites taken offline after ...

2026-10-12T20:08:54Z

🚨🇺🇸 Giant Food websites taken offline after cybersecurity incident at parent company Ahold Delhaize

Websites for The GIANT Company, Giant Food, Food Lion, Hannaford and Stop & Shop were taken offline after Ahold Delhaize detected a security issue within its network.

Online grocery ordering and deliveries have been disrupted while systems are kept offline as a precaution. The company’s physical stores remain open and continue serving customers.
⠀
The incident is also affecting several European Ahold Delhaize brands, including Albert Heijn, Etos, Gall & Gall and Delhaize.

Ahold Delhaize has not disclosed how its network was compromised, identified an attacker or confirmed whether any data was stolen. There is currently no estimated restoration time.

Source: https://lancasteronline.com/news/local/giants-website-taken-down-following-cyber-attack-on-parent-company/article_808bae86-cb7b-41f5-8b1d-8c006c65e569.html

🚨🇫🇷 Solutions30 Dataset Containing Over 10.3 Million ...

2026-10-12T19:41:41Z

🚨🇫🇷 Solutions30 Dataset Containing Over 10.3 Million Records Offered for Sale

Solutions30, a European company providing technical installation, maintenance, and support services across the telecommunications, energy, and technology sectors, has been named in a major data sale.

The actor "Syrv4x" claims to have obtained a 34 GB dataset containing 10,376,950 records, including nearly 4 million distinct names, 6.8 million unique phone numbers, and 981,883 unique email addresses.

The records also contain customer addresses, service locations, and operational information linked to companies using Solutions30's field services.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 AnyPS5: An open-source project for automatically porting PS5 ...

2026-10-12T17:35:19Z

🚨 AnyPS5: An open-source project for automatically porting PS5 executables to Linux and Windows

GitHub: https://github.com/boykopovar/AnyPS5

AnyPS5 converts PS5 executables into formats that can run natively on supported desktop systems, while reimplementing required PS5 system libraries for dynamic linking.

Features include:

• Automatic executable relinking
• Linux and Windows support
• SPIR-V shader recompilation
• Controller support
• Configurable keyboard and mouse input
• No separate emulator runtime process

The project is focused on interoperability, preservation, research, and compatibility, with a growing list of verified games.

Mr. Swirl has been added to the OpSec Failures page. Direct file: ...

2026-10-12T16:57:20Z

Mr. Swirl has been added to the OpSec Failures page.

Direct file: https://darkwebinformer.com/opsec-failures/#file-mr-swirl

🚨🇳🇱 Albert Heijn warns of empty shelves as cybersecurity ...

2026-10-12T16:43:48Z

🚨🇳🇱 Albert Heijn warns of empty shelves as cybersecurity incident shuts down distribution systems

Several Albert Heijn distribution centers have stopped operating after parent company Ahold Delhaize detected a security issue within its network and took systems offline.

The disruption is affecting store deliveries, with shortages of fresh products such as fruit and vegetables expected over the coming days. Frozen food, bread and longer-lasting products are expected to remain more widely available.
⠀
The incident has also affected Albert Heijn, Etos and Gall & Gall websites, apps and customer services. All existing online grocery orders have been cancelled and no new orders can be placed or delivered.

Stores remain open and payment systems continue to work, but personal discounts, digital savings programs and some other services are unavailable.

The cause has not been disclosed, and there is currently no confirmation that customer data was stolen.

Source: https://nieuws.ah.nl/mediastatement-inzake-it-incident/

🚨🇵🇦 MiGuayaba and MGPanel Documents Allegedly Leaked, ...

2026-10-12T16:33:12Z

🚨🇵🇦 MiGuayaba and MGPanel Documents Allegedly Leaked, Nearly 19,000 Files Exposed

MiGuayaba, a Panamanian marketing and web design agency, and MGPanel, a business management software platform, have been named in a data leak involving approximately 10 GB of documents.

The actor "gea" claims to have exposed 19,080 files, including 8,979 identity documents, 6,238 business operation notices, contracts, financial statements, tax records, and corporate registration documents.

The information reportedly belongs to clients across Panama, Colombia, and Venezuela. Samples showing identification cards and other sensitive documents have also been published.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 A directory containing information on 30,416 online sellers ...

2026-10-12T16:19:41Z

🚨 A directory containing information on 30,416 online sellers has been published, with data collected from BlackHatWorld, Babiato, and BitcoinTalk.

The actor "Redwire" claims the collection includes 619 sellers with publicly available contact information and 1,386 contact entries covering Telegram, email, Skype, and WhatsApp.

The dataset organizes sellers by services such as SEO, social media marketing, account sales, proxies, and advertising. It also includes seller profiles, discussion links, and descriptions of their services.

A sample of 200 entries is available, while the complete 4.9 MB dataset requires forum points to access.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 BT MOB 3.6.3 Android RAT Source Code Released The source ...

2026-10-12T16:09:08Z

🚨 BT MOB 3.6.3 Android RAT Source Code Released

The source code for BT MOB 3.6.3, an Android remote access trojan (RAT), has been shared online by an actor known as "procurator."

The malware is described as being developed by the same individual behind CraxsRAT and CypherRAT. It uses Android Accessibility Services to gain extensive control over infected devices, including live screen monitoring, credential theft through fake login overlays, keylogging, and remote file access.

Additional capabilities include intercepting SMS messages and authentication codes, recording audio, tracking GPS locations, and communicating with its command-and-control server through WebSockets.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 AlloExtra User Profiles and CVs Offered for Sale ...

2026-10-12T16:02:15Z

🚨🇫🇷 AlloExtra User Profiles and CVs Offered for Sale

AlloExtra, a French employment and recruitment platform, is the subject of a data sale involving thousands of job seekers.

The actor "Feel" claims to have collected 14,516 CVs, 14,268 user profiles, and 6,674 additional image records. The information includes names, employment histories, professional experience, contact details, and photographs.

The listing describes the dataset as a complete scrape of the platform's users.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 Hackers remotely heat supermarket refrigerators to ...

2026-10-12T15:30:52Z

🚨🇫🇷 Hackers remotely heat supermarket refrigerators to 50°C, destroying food and causing fires across France

A large-scale cyberattack targeted connected refrigeration systems at hundreds of French supermarkets overnight.

Around 150 Intermarché stores and nearly 100 Coopérative U locations were affected. The attackers reportedly activated the systems’ forced-defrost function remotely, causing some refrigerators to remain at 50°C for approximately six hours.
⠀
Affected stores were forced to discard fresh and frozen food to prevent health risks. The Paris prosecutor’s office said the attack also caused several fires.

The incident affected refrigeration management systems supplied by Danish manufacturer Danfoss. The company said the affected units were running outdated firmware and urged customers to update supported systems or replace legacy equipment.
⠀
France’s cybersecurity agency ANSSI is investigating and coordinating with other European countries over concerns that systems outside France may also be affected.

No attacker or motive has been publicly identified.

Source: https://www.reuters.com/business/retail-consumer/french-supermarket-chain-intermarche-hit-by-cyberattack-150-stories-targeted-2026-10-12/

🚨🇺🇸 Access to the internal systems of an unidentified ...

2026-10-12T00:25:36Z

🚨🇺🇸 Access to the internal systems of an unidentified U.S. fitness equipment company is being advertised for sale.

The seller, operating under the handle "888," claims to have access to the company's MySQL database, Amazon S3 storage, and Shopify platform. The business reportedly generates $27 million in annual revenue.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Building a new tool, ASN Scout. It's a Python-based ASN ...

2026-10-12T00:12:08Z

Building a new tool, ASN Scout.

It's a Python-based ASN scanner with an interactive ASCII menu that discovers associated IP ranges, checks for live hosts, and collects HTTP responses, headers, open ports, TLS certificates, and more.

Includes live scanning progress, configurable scan options, and exportable reports.

When? Maybe end of October.

🚨🇫🇷 KIASSURE Insurance Dataset Containing 128,243 ...

2026-10-11T23:06:45Z

🚨🇫🇷 KIASSURE Insurance Dataset Containing 128,243 Records Leaked

KIASSURE, a French wholesale insurance broker based in Marseille, has been named in a data leak involving 128,243 records.

The actor "Syrv4x" has released a 221 MB dataset containing customer names, email addresses, phone numbers, Social Security numbers, bank account information, and insurance policy details.

The samples also include beneficiaries, health insurance coverage, premium information, and contract statuses.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️🇫🇷 Actor looking for abandoned houses in France... ...

2026-10-11T22:29:35Z

‼️🇫🇷 Actor looking for abandoned houses in France...

🚨🇲🇽 iPESA Pinturas Customer and Administrative Data ...

2026-10-11T20:02:40Z

🚨🇲🇽 iPESA Pinturas Customer and Administrative Data Allegedly Leaked

iPESA Pinturas, a Mexican manufacturer and distributor of paints and coatings, has been named in a data leak involving several company branches.

The actor "RevelationS" claims to have extracted customer names, email addresses, phone numbers, tax identifiers (RFC), supplier information, and financial records.

Published samples also show branch administrator usernames and plaintext passwords, raising concerns about unauthorized access to company systems.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇩🇴 Dominican Republic Electoral Registry Dataset With ...

2026-10-11T19:02:55Z

🚨🇩🇴 Dominican Republic Electoral Registry Dataset With 6.8 Million Records and 5.6 Million Photos Allegedly Exposed

An actor known as "wenhao" claims to have extracted more than 6.8 million citizen records and 5.6 million photographs from the Dominican Republic's electoral registration system.

The dataset allegedly contains national identification numbers (cédulas), full names, dates of birth, birthplaces, marital statuses, blood types, and occupations.

The actor has published samples of the records and identification photographs. The files reportedly total approximately 20.7 GB.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Update, since I haven't posted one in a week or two. I'm ...

2026-10-11T17:21:37Z

Update, since I haven't posted one in a week or two.

I'm currently working on a new subscription tier intended exclusively for companies, enterprises, law enforcement, government agencies, and similar organizations.

Access will require manual verification. I haven't finalized the verification process yet, but it will be entirely digital.

This tier will introduce specialized intelligence feeds, including a d*x tracker, darknet market intelligence, and other feeds that aren't currently available on the platform. Everything is still in the early stages of development. API access is still a completely different offering.

The new service directory is also being worked on. I have roughly 500 additional clearnet and onion sites waiting to be added, along with improvements to how the directory is managed.

A few other updates:

• Forum monitoring has expanded to over 300 sections across 30+ forums.

• Improvements to the ransomware feed is ongoing.

• Additional backend improvements are being worked on across the platform.

There's quite a bit more planned, but I'd rather announce things when they're further along.

🚨🇫🇷 Armurerie du Bocage Customer Records and Identity ...

2026-10-11T16:56:08Z

🚨🇫🇷 Armurerie du Bocage Customer Records and Identity Documents Offered for Sale

Armurerie du Bocage, a French retailer specializing in firearms, hunting equipment, and shooting accessories, has been named in a new data sale.

The actor "ChimeraZ" is selling 284 MB of data containing 574 files and 12,606 records relating to approximately 1,000 individuals.

The dataset reportedly includes 127 identity files, 439 invoices, customer contact details, purchase histories, and firearm-related licensing information.

Claim is currently unverified.

Infostealer data via @whiteintel_io (X)

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇰🇭 NTC Group School Management System Access Offered ...

2026-10-11T16:44:24Z

🚨🇰🇭 NTC Group School Management System Access Offered for Sale in Cambodia

An actor known as "DaOnlySpark" is selling access to NTC Group's school management system, covering two Sovannaphumi School campuses in Cambodia.

The affected campuses reportedly serve approximately 10,000 students combined, with 7,000 in Poipet and 3,000 in Siem Reap.

The actor claims the access allows buyers to view student records and payments, transfer or remove students, upload student photos, and modify staff signatures. Access to either campus or both is being offered to interested buyers.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

ShinyHunters relay[.]to[.]stakenodes[.]org ...

2026-10-11T16:24:04Z

ShinyHunters

relay[.]to[.]stakenodes[.]org

🚨🇫🇷 AK Transport Dataset Containing 11,681 Shipping ...

2026-10-11T16:14:14Z

🚨🇫🇷 AK Transport Dataset Containing 11,681 Shipping Records Leaked

AK Transport, a French road freight company based in Saint-Étienne, has been named in a data leak involving 11,681 records.

The actor "Syrv4x" has released a 127 MB dataset containing customer names, phone numbers, email addresses, delivery locations, shipment details, and tracking histories.

The samples also include waybill numbers, delivery confirmations, driver information, and proof-of-delivery records.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 G La Dalle Dataset Containing 46,757 Records Leaked ...

2026-10-11T16:07:23Z

🚨🇫🇷 G La Dalle Dataset Containing 46,757 Records Leaked

G La Dalle, a French fast-food chain known for its American-style burgers, has been named in a new data leak.

The actor "Syrv4x" has released a 318 MB dataset containing 46,757 records, including customer names, phone numbers, email addresses, delivery addresses, order histories, and loyalty program information.

The records also include transaction details, restaurant identifiers, and account-related fields.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 RGIS Recruitment Dataset Containing 30,366 Records ...

2026-10-11T15:54:05Z

🚨🇫🇷 RGIS Recruitment Dataset Containing 30,366 Records Leaked

RGIS, an international company providing inventory, supply chain, and asset management services, has been named in a new data leak involving job applicants in France.

The actor "Syrv4x" has shared a 28 MB dataset containing 30,366 records, including applicant names, email addresses, phone numbers, job applications, recruitment statuses, and interview schedules.

The samples also contain links to candidate CVs, recruiter communications, and application histories.

Claim is currently unverified.

Infostealer data via @whiteintel_io (X)

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇧🇷 Cássia Municipal Government Credentials and 10 GB ...

2026-10-11T15:43:14Z

🚨🇧🇷 Cássia Municipal Government Credentials and 10 GB of Files Allegedly Exposed

An actor known as "Zyrav" claims to have compromised government systems belonging to the Brazilian municipality of Cássia.

The actor is sharing an archive containing 2,445 files, totaling 10 GB uncompressed, including financial documents, employee records, backups, NDAs, and administrative credentials.

The listing also claims that government email accounts, official websites, and donation systems can be accessed using the exposed credentials, some of which the actor says were tested successfully.

Claim is currently unverified.

Infostealer data via @whiteintel_io (X)

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 Grand Delta Habitat Dataset Containing 188,010 ...

2026-10-11T15:19:23Z

🚨🇫🇷 Grand Delta Habitat Dataset Containing 188,010 Records Offered for Sale

Grand Delta Habitat, a French social housing provider specializing in affordable housing, property management, and residential development, has been named in a new data sale.

The actor "mica" is selling a 272 MB dataset containing 188,010 records, including tenant contact information, property addresses, maintenance requests, service descriptions, and billing details.

A sample of the records has been published, with the seller accepting offers for the full dataset.

Claim is currently unverified.

Infostealer data via @whiteintel_io (X)

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 Grand Delta Habitat Dataset Containing 188,010 ...

2026-10-11T15:19:03Z

⚠️ Dread is back online after being down for almost 24 hours. ...

2026-10-11T15:03:35Z

⚠️ Dread is back online after being down for almost 24 hours.

Again the new Dread URL is: https://dreadohblesmagfagqup24vw7catlvmqhhce5itz7wxr4vffgemjzaad[.]onion

🚨🇦🇺 Icon Cancer Centre Patient Records Offered for Sale ...

2026-10-11T00:10:07Z

🚨🇦🇺 Icon Cancer Centre Patient Records Offered for Sale

An actor is offering more than 31,300 confidential patient documents allegedly obtained from Icon Cancer Centre, an Australian network of specialist cancer treatment clinics.

The files reportedly contain patient identities, cancer diagnoses, medical histories, laboratory results, treatment plans, and chemotherapy and radiation therapy records.

The actor "2019" has published a sample and is offering the dataset to a single buyer for cryptocurrency.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

⚠️ Dread has been down for the majority of the day due to an ...

2026-10-10T22:27:50Z

⚠️ Dread has been down for the majority of the day due to an unknown attacker DDoSing it.

🚨 GoSearch: an OSINT tool for searching a person’s digital ...

2026-10-10T20:57:52Z

🚨 GoSearch: an OSINT tool for searching a person’s digital footprint across 300+ websites

GitHub: https://github.com/ibnaleem/gosearch

GoSearch is a Go-based username reconnaissance tool designed to quickly identify accounts tied to the same handle across social platforms and websites.

Features include:

• Username searches across 300+ sites
• False-positive filtering
• HudsonRock breach-data lookups
• ProxyNova breach searches
• BreachDirectory integration
• Common TLD/domain discovery
• Concurrent scanning for faster results

A useful tool for quickly mapping usernames, exposed accounts, and associated breach data from a single CLI.

Pushed a couple fixes to the backend for the threat feed. Script ...

2026-10-10T18:31:14Z

Pushed a couple fixes to the backend for the threat feed.

Script failed for approximately 4 hours today due to overwhelming the server with specific SOCKS5 requests. Provided an improvement on this and monitoring. No posts were missed.

Alerts now use stronger fallback logic when AI classification fails, helping correctly identify data leaks, breaches, cyber attacks, combo lists, and other threat types instead of defaulting to generic “Alert” posts.

‼️ DexCom has been named by REDACT ransomware. DexCom was ...

2026-10-10T18:04:18Z

‼️ DexCom has been named by REDACT ransomware. DexCom was previously named by ShinyHunters.

🚨🇫🇷 Auchan Customer Dataset With 1.29 Million Records ...

2026-10-10T17:17:21Z

🚨🇫🇷 Auchan Customer Dataset With 1.29 Million Records Offered for Sale

Auchan, one of France's largest retail chains, has been named in a new data sale on a cybercrime forum.

The actor "mica" is selling a 471 MB dataset containing 1,291,037 customer records, including names, email addresses, phone numbers, home addresses, and customer card numbers.

A sample of the records has been published, with the seller accepting offers for the full dataset.

Claim is currently unverified.

Infostealer data via @whiteintel_io (X)

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 Infogreffe Allegedly Breached, 3.7 Million Records ...

2026-10-10T17:05:05Z

🚨🇫🇷 Infogreffe Allegedly Breached, 3.7 Million Records Claimed

Infogreffe, a French platform providing official business registration information and legal documents, has been named in a new breach claim attributed to "LunarisSec."

The actor claims to have compromised administrative systems and extracted approximately 3.7 million records, including authentication logs, user profiles, email addresses, IP addresses, and API-related information.

The listing also claims access to SMTP credentials, secret keys, and administrative account details. Samples and download links have been published.

Claim is currently unverified.

Infostealer data via @whiteintel_io (X)

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 Double Counter Dataset Containing 274,461 Records Shared on ...

2026-10-10T16:55:09Z

🚨 Double Counter Dataset Containing 274,461 Records Shared on Forum

Double Counter, a Discord server protection and verification service, has been named in a data leak involving 274,461 records.

The actor "MeowGang67" claims the data originated from a breach involving a vulnerability in the Metabase analytics platform. The exposed information reportedly includes approximately 275,000 email addresses and Discord usernames.

A smaller portion also contains paying subscriber information processed through Stripe, including names, countries, postal codes, and subscription details.

Claim is currently unverified.

Infostealer data via @whiteintel_io (X)

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 VD2E Customer Dataset With 86,000 Records Offered ...

2026-10-10T16:45:20Z

🚨🇫🇷 VD2E Customer Dataset With 86,000 Records Offered for Sale

VD2E, a French company specializing in administrative services for renewable energy and home renovation projects, has been named in a new data sale on a cybercrime forum.

The actor "Alduin" is selling a dataset advertised as containing 86,000 customer records dating from August 2019 to October 2026.

The records include customer names, addresses, phone numbers, email addresses, prospect identifiers, and account information. A sample of 1,000 records has been shared, with the seller accepting offers in Monero (XMR).

Claim is currently unverified.

Infostealer data via @whiteintel_io (X)

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 Callibri Dataset With 61,000 Records Allegedly ...

2026-10-10T16:35:04Z

🚨🇫🇷 Callibri Dataset With 61,000 Records Allegedly Leaked

Callibri, a French company providing telephone answering, appointment scheduling, and calendar management software for professionals, has been named in a data leak.

The actor "mondial" has shared a dataset advertised as containing 61,000 records. Samples include customer names, phone numbers, email addresses, physical addresses, dates of birth, appointment history, and contact notes.

Claim is currently unverified.

Infostealer data via @whiteintel_io (X)

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇮🇳 Uttar Pradesh Metro Rail Corporation Targeted in ...

2026-10-10T16:26:12Z

🚨🇮🇳 Uttar Pradesh Metro Rail Corporation Targeted in $15,000 Ransom Demand

An actor representing the "Reze" ransomware group claims to have obtained data from Uttar Pradesh Metro Rail Corporation (UPMRC), an Indian government-owned metro rail operator.

The 5.9 MB dataset allegedly contains information on more than 2,000 users, including names, phone numbers, ticket orders, payment transactions, and refund details.

The group is demanding $15,000 and threatens to leak the data if payment is not made.

Claim is currently unverified.

Infostealer data via @whiteintel_io (X)

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing