π¨π«π· Initial Access: French Pharmaceutical Company A threat actor is advertising RDWeb access to an unnamed pharmaceutical company in France reportedly generating $25M-$50M in revenue. The advertised access includes Domain Admin privileges within a network of approximately 250 hosts.
No BS check run yet β press β to extract this story's claims and verify them against independent sources.
π¨π«π· Initial Access: French Pharmaceutical Company A threat actor is advertising RDWeb access to an unnamed pharmaceutical company in France reportedly generating $25M-$50M in revenue. The advertised access includes Domain Admin privileges within a network of approximately 250 hosts. Trend Micro Apex One is reportedly deployed in the environment. The access is listed for $420. This claim is curr
π¨ Initial Access: IT Security Company A threat actor is advertising RDP access to an unnamed IT security company, claiming access to Microsoft Teams, Outlook, a premium CRM platform, SharePoint, and an internal workstation. The actor also claims the compromised system contains password files, credit card information, and internal account access. They further state that lateral movement may be pos
π¨ πΊπΈ Initial Access: Xpressdocs Account Linked to SERHANT. Ransomware actor "ShadowByt3$" is advertising access to an Xpressdocs account allegedly tied to a SERHANT. corporate email address. The actor claims a payment card is attached to the account and can be used to make purchases through Xpressdocs. The access is listed for $30 in BTC or XMR via escrow. This claim is currently unverified. π₯
π¨ π«π· Initial Access: GSE Group VPN + RMM Environment Ransomware actor "ShadowByt3$" is advertising alleged VPN and remote management access linked to GSE Group, an engineering and construction company. The actor claims access through an industrial management platform with administrative privileges and remote connectivity into internal environments. The post further claims the infrastructure pro
π¨πΈπ¦ Access to unnamed Saudi company allegedly exposing over 500 GB of data offered for $1,500 β A forum actor using the handle "Roxanne" claims to be selling access to a company in Saudi Arabia with stated capital of SAR 100 million. β The actor describes a network using Fortinet infrastructure with more than 10 Windows devices and access to a domain controller. β Claimed access and exposed mat
π¨ Android spyware and RAT source code advertised for $500 β A forum actor using the handle "greekdev" is advertising an Android surveillance application, including its client source code, server code, and web-based control panel. β Some of the claimed capabilities include: β β’ Live microphone, camera, and screen monitoring β’ Call recording across messaging apps β’ Keylogging, SMS tracking, and not
π¨πΈπͺ Hitta business dataset containing nearly 1.5 million records advertised for $280 β Hitta is a Swedish business and contact directory. β A forum actor using the handle "NodeScraper" claims to be selling 1,495,005 business records scraped from Hitta. β Some of the advertised data includes: β β’ Company names and organization numbers β’ Email addresses and phone numbers β’ Business addresses and
π¨π«π· LVMH internal credentials and vulnerability information allegedly offered for sale β LVMH is a French luxury goods group spanning fashion, jewelry, cosmetics, wines, and spirits. β A forum actor using the handle "HollowCrimeCorp" claims to be offering a package of internal assets and information related to LVMH. β The advertised package includes: β β’ Internal URLs and access portals β’ Admin
π¨π«π· Mes MarchΓ©s dataset allegedly exposes 2,535 exhibitor records β A forum actor using the handle "Quantique" claims to have released a dataset from French platform Mes MarchΓ©s after accessing its API. The actor also claims to have scraped all hosted images. β Some of the claimed exposed material includes: β β’ Names, email addresses, and phone numbers β’ Addresses and location coordinates β’ Bus
π¨π«π· Autobacs customer and booking data allegedly leaked β A forum actor using the handle "0xDzz" claims to have released part of a dataset belonging to automotive parts retailer Autobacs, containing approximately 34,000 records totaling 159 MB. β Some of the claimed exposed material includes: β β’ Customer names, email addresses, and phone numbers β’ Vehicle registration numbers β’ Appointment dat
π¨π«π· UniFormation dataset allegedly exposes 1,200 records β A forum actor using the handle "Quantique" claims to have released a UniFormation dataset after exploiting an API bug through a user account. β Claimed exposed material includes: β β’ First and last names β’ Dates of birth β’ French national identification numbers (NIR) β The actor advertises a 1,000-record sample and says maintenance prev
π¨πͺπΊ Twizzit dataset allegedly containing 1.53 million members offered for sale β Twizzit is a club management platform used by sports organizations, youth groups, choirs, and nonprofits. β A forum actor using the handle "RedStone" is advertising a 1.4 GB dataset allegedly covering more than 5,500 organizations and over 17 years of data. β Some of the claimed exposed material includes: β β’ 1.53
π¨π§πͺ JIMS dataset allegedly exposes 150,000 customer records, including banking details β A forum actor using the handle "ZMLOOKUP" claims to possess a dataset containing 150,000 customer records from fitness club operator JIMS. β Some of the claimed exposed material includes: β β’ Names, dates of birth, and gender β’ Addresses, phone numbers, and email addresses β’ IBANs and bank account holder na
π¨π¨π± DealerNET data and account access allegedly offered for 35 BTC β A forum actor using the handle "Karim000" claims to possess more than 100 GB of DealerNET data and access to over 5,000 platform accounts, including those used by banks, insurers, automotive businesses, and pension fund administrators. β Some of the claimed exposed material includes: β β’ Personal reports on Chilean citizens, j
π¨π«π· BackPower allegedly breached, dataset advertised for $5,000 β BackPower is a French company that reconditions batteries and manufactures compatible replacements, including batteries for electric bicycles. β A forum actor using the handle "Quantique" claims to have compromised BackPower and is selling a dataset advertised as containing 47 million records. β Some of the claimed exposed materi
π¨π°πΌ 2,733 Kuwait University employee records allegedly leaked β Names, university email addresses, and faculty information are among the data a forum actor claims to have released from Kuwait University, a public university in Kuwait. β The actor, "lulzintel," posted sample records and placed the full download behind a forum reply requirement. β The advertised dataset also includes employee ide
π¨ Windows password and PIN sniffer tool shared on a forum β An actor using the handle "Apollinaris" is distributing a tool advertised as capturing local Windows user and administrator passwords or PINs. β The screenshots show a Windows Update impersonation prompt asking the victim to enter credentials to approve a supposed Wi-Fi driver update. β The actor provides separate password and PIN versio
π¨ Activa Group insurance dataset allegedly leaked with 18,765 records β Activa Group provides insurance services across several African countries. β A forum actor using the handle "fuie" claims to have released a dataset containing 18,765 rows linked to the group. β Some of the claimed exposed material includes: β β’ Names, dates of birth, and gender β’ Phone numbers and client contact details β’ In
π¨ π«π· Nearly 1.1 million business records linked to 118 712 offered for sale β 118 712 is a French directory service listing businesses and individuals. β Forum actor "NodeScraper" claims to be selling a dataset containing 1,098,583 business records. β The advertised data includes: β β’ Company names and registration numbers β’ Email addresses and phone numbers β’ Addresses and geographic coordinat
π¨ Opinion Space dataset allegedly leaked, affecting over 142,000 members β Opinion Space is an online market research community and survey panel company. β A known actor using the alias "888" claims to have breached the company in September 2026 and released a dataset covering more than 142,000 unique members. β Some of the claimed exposed data includes: β β’ Names and dates of birth β’ Email addre
π¨ π΅πͺ Actor claims to have obtained medical data linked to Peruβs National Police β An actor using the handle "cutzinger" posted a sample of allegedly obtained records linked to Peruβs national police force, referencing "SoulhemTeam." β Some of the claimed data includes: β β’ Names, national ID numbers, and contact details β’ Dates of birth and family relationships β’ Medical histories, disabilitie
π¨ πͺπΈ Actor offers 11.4 million Spanish identity documents for sale β An actor using the handle "Harley", claims to have obtained the documents in June 2026 by breaching Spainβs State Digital Administration Agency. β Some of the claimed data includes: β β’ National ID numbers and full names β’ Facial photographs and signatures β’ Birth details, addresses, and parentsβ names β’ Document numbers, expi
π¨ VPN access to a construction firm advertised for $200 β An actor using the handle "Spider777" is offering VPN access to an unnamed construction firmβs network. The listing is tagged FortiClient and claims the company has revenue below $5 million. β Advertised terms: β β’ Starting bid: $150 β’ Minimum increment: $10 β’ Buy-now price: $200 β’ Auction ends: October 1, 2026 β The companyβs location, ac
π¨ π΅πΎ Paraguayβs electoral candidate registration system allegedly breached β The Candidate Registration System (SIC) is used by Paraguayβs Superior Court of Electoral Justice (TSJE). β An actor using the handle "Zumarius" claims to have leaked 325 account records containing data belonging to candidates and TSJE employees. β Some of the claimed exposed data includes: β β’ Names and national ID nu
βΌοΈπ¨π A forum actor advertises 300 ProtonMail accounts claimed to be fully working, including username, password, and cookies for each account. π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
βΌοΈBREAKING: Popular gaming platform Gaggle.fun appears to have been breached. Created by Gaggle Studios, the platform hosts multiplayer party and social games with built-in voice chat, including Goose Goose Duck, 7 Minutes in Hell, and Dumpster Divers. An actor claims they accessed Gaggle.funβs admin panel and copied its player dataset. Screenshots they shared appear to show the admin dashboard, p