@DarkWebInformer@infosec.exchange

@DarkWebInformer@infosec.exchange · Aug 06, 2026

🚨🇮🇳 Tit-Bit Foods data allegedly leaked following ransomware attack ⠀ A forum actor claims to have infected a computer belonging to Tit-Bit Foods, an Indian food company, with ransomware and published company data after a payment was not made. ⠀ The post includes: ⠀ • Multiple download links containing the allegedly stolen files • Images said to show the infected computer • A claim that the attack involved “Luzy Ricardo Milos” ransomware ⠀ This claim is currently unverified. ⠀ 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Aug 05, 2026

🚨🇺🇸 Allstate-branded staging CRM data allegedly exposed through misconfigured Firebase database ⠀ A forum actor claims to have discovered a publicly accessible Firebase Realtime Database tied to an Allstate-branded tax preparation and client management platform. The actor says the staging environment allowed unauthenticated read and write access. ⠀ The exposed data allegedly includes: ⠀ • 968 Stripe transactions totaling approximately $182,830 • 20 Stripe production customer identifiers • Seven business accounts with tax and incorporation information • Eleven user profiles containing names, emails, phone numbers and Social Security numbers • Session, ID and refresh tokens • Nine SMS threads containing 26 messages between agents and clients • Tax return documents and other conversation attachments • Eleven employee pay periods with hours worked • Six Firebase Storage download tokens • Billing records, invoice identifiers and payment statuses ⠀ The actor claims write access was tested across five database endpoints, potentially allowing records, accounts, conversations and payment information to be modified. A database export and supporting files were also advertised for download. ⠀ The post attributes the environment to Allstate, but the displayed records reference Allstate Tax LLC and other tax preparation clients. The relationship to Allstate Corporation has not been independently confirmed. ⠀ This claim is currently unverified. ⠀ 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Aug 05, 2026

🚨🇺🇸 HVMN customer and payment-related data allegedly leaked ⠀ A forum actor claims to have leaked data belonging to HVMN, formerly known as Nootrobox and now operating as Ketone-IQ, a US performance nutrition company. ⠀ The post advertises 86,904 user profiles, including: ⠀ • 57,209 unique email addresses • 44,474 unique full names • 48,201 unique IP addresses • 6,785 card-on-file records • 39,230 Stripe customer identifiers • 8,993 cities across 41 countries • 14,424 shipping postal codes • 1,273 subscription identifiers ⠀ The exposed fields allegedly include: ⠀ • Names, email addresses and phone numbers • IP addresses and internal user identifiers • Shipping and billing addresses • Stripe customer and subscription data • Revenue and Google Analytics identifiers • Masked payment card numbers and security codes • Card expiration dates and billing postal codes • Account creation timestamps The actor also claims additional user and event data may be released later. ⠀ This claim is currently unverified. ⠀ 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Aug 05, 2026

🚨🇫🇷 Maxi Zoo customer records allegedly offered for sale ⠀ A forum actor claims to be selling a database belonging to Maxi Zoo, a major pet supplies retailer operating in France. ⠀ The listing advertises 3,416,030 customer records dated August 1, 2026, including: ⠀ • First and last names • Primary and secondary phone numbers • Email addresses • Street addresses • Postal codes and cities ⠀ A sample was published alongside the listing. The full dataset is priced at $700. ⠀ This claim is currently unverified. ⠀ 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Aug 04, 2026

‼️ New Dark Web Informer Blog Post! Title: Vendor Advertises Fraudulently Verified Crypto Exchange Accounts With European Bank Rails Link: https://darkwebinformer.com/vendor-advertises-fraudulently-verified-crypto-exchange-accounts-with-european-bank-rails/ 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

Dark Web Informer

Vendor Advertises Fraudulently Verified Crypto Exchange Accounts With European Bank Rails

A seller posting as RasselKyc is advertising made-to-order cryptocurrency exchange accounts registered under names supplied by the buyer.

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Aug 04, 2026

‼️ New Dark Web Informer Blog Post! Title: Waggle Database Allegedly Leaked, 106,800+ Pet Camera Customers Exposed Across Three Tables Link: https://darkwebinformer.com/waggle-database-allegedly-leaked-106-800-pet-camera-customers-exposed-across-three-tables/ 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

Dark Web Informer

Waggle Database Allegedly Leaked, 106,800+ Pet Camera Customers Exposed Across Three Tables

A forum user posting as 2019 has published what they describe as the customer database of Waggle, a US pet technology company whose products include a smart camera offering live video, two-way audio,

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Aug 04, 2026

‼️🇨🇦 A threat actor is offering a 55 GB database allegedly from a Canadian credit company, containing over 40,000 files including customer ID photos, PDFs, and statements tied to approximately 28,000 customers.

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Aug 04, 2026

🚨🇲🇽 Irapuato municipal job board applicant data allegedly leaked ⠀ A forum actor claims to have leaked approximately 17,000 records from Bolsa de Empleo Irapuato, a municipal employment portal operated by the Government of Irapuato in Mexico. ⠀ The exposed data allegedly includes: ⠀ • Applicant names and facial photographs • CURP national identification numbers • Home addresses, phone numbers and email addresses • Complete résumés and employment histories • Skills and desired salaries • Preferred positions and employment types • Job categories • Education histories, grades and previous schools ⠀ This claim is currently unverified. ⠀ 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Aug 04, 2026

🚨🇪🇸 GTD defense project files allegedly offered for sale ⠀ A forum actor claims to be selling 3.58GB of files belonging to GTD, a Spanish defense technology company involved in sensitive aerospace, naval and military projects. ⠀ The listing references work connected to Navantia, Airbus, the European Space Agency and other defense programs. ⠀ The advertised files allegedly include: ⠀ • Technical diagrams, cabling plans and hardware specifications • Sensor and weapons integration documentation • Operations and maintenance manuals • Factory acceptance and impedance test reports • Contracts, meeting minutes and progress reports • Confidentiality and ITAR-related clauses • Spare-parts lists, lead times and reliability data • Chemical specifications for coatings used in military equipment • PDF, Excel and CAD files marked confidential ⠀ The seller claims the compressed dataset totals 2.71GB and is seeking offers for the full collection. ⠀ This claim is currently unverified. ⠀ 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Aug 04, 2026

Replying to @DarkWebInformer@infosec.exchange

Source: https://www.euronews.com/my-europe/2026/08/03/alleged-operator-of-major-darknet-drugs-platform-charged-in-germany

www.euronews.com

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Aug 04, 2026

🚨🇩🇪 Archetyp Darknet Market operator charged over €330M darknet drug trade German prosecutors charged a 31-year-old man accused of founding and administering Archetyp Market, once described as the world’s largest darknet marketplace for illegal drugs. Authorities say the platform processed around 2.3 million orders between November 2022 and its June 2025 shutdown, generating an estimated €330 million in sales. Archetyp allegedly had more than 600,000 customer accounts, around 3,000 professional vendors, and 17,000 listings for cocaine, heroin, fentanyl, methamphetamine, cannabis, prescription drugs, and other substances. The suspect allegedly collected a 5% commission and other fees, earning around €20 million. He was arrested (video) in Barcelona during Operation Deep Sentinel and later extradited to Germany. Authorities have seized nearly €10 million in cryptocurrency, cash, and luxury vehicles. He faces up to 15 years in prison if convicted.

0

1

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 31, 2026

🚨🇨🇦 Qtrade Direct Investing customer records allegedly offered for sale A forum actor claims to be selling 152,284 records associated with Qtrade Direct Investing, a Canadian online investment and brokerage platform. The listing states the data is dated July 25, 2026, and is being offered to a single buyer for $300. The data allegedly includes email addresses, first and last names, home addresses, cities, provinces or states, postal codes, phone numbers, gender, lead-check information, and internal user-type classifications. This claim is currently unverified. 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing

0

1

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 31, 2026

🚨🇫🇷 Shokz customer records allegedly offered for sale A forum actor claims to be selling 48,284 records associated with Shokz, a consumer electronics company known for its open-ear headphones. The listing is dated July 30, 2026, and appears to involve customers of the company’s French online store. The data allegedly includes first and last names, street addresses, cities, postal codes, countries, phone numbers, and email addresses. The dataset is priced at $120, with the seller claiming it will only be sold once. This claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 31, 2026

‼️ New Dark Web Informer Blog Post! Title: Baltas Online Allegedly Breached, 750+ Turkish Companies Exposed Through HR Assessment Vendor Link: https://darkwebinformer.com/baltas-online-allegedly-breached-750-turkish-companies-exposed-through-hr-assessment-vendor/ 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 31, 2026

🚨🇲🇽 Hospital México Americano patient database and CT scans allegedly leaked A forum actor claims to have compromised Hospital México Americano and published a 9.1GB collection containing its patient database and medical imaging files, including CT scans. The exposed data allegedly includes patient names, identifiers, sex, dates of birth, ages, study identifiers, accession numbers, examination descriptions, study timestamps, and associated diagnostic images. A sample of the CT scan data was also posted. This claim is currently unverified. 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 31, 2026

‼️ New Dark Web Informer Blog Post! Title: Hungarian State Treasury Allegedly Compromised, Actor Claims vCenter and Identity Vault Access Link: https://darkwebinformer.com/hungarian-state-treasury-allegedly-compromised-actor-claims-vcenter-and-identity-vault-access/ 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

Dark Web Informer

Hungarian State Treasury Allegedly Compromised, Actor Claims vCenter and Identity Vault Access

A threat actor posting as bytetobreach claims to have compromised the Magyar Államkincstár, Hungary's State Treasury, which administers state payments, pensions, family benefits, and EU funding.

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 30, 2026

When the feds find an IP leak

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 30, 2026

🚨🇲🇽 Veracruz citizen assistance system database allegedly leaked A forum actor claims to have leaked data from Veracruz’s Sistema Institucional de Atención Ciudadana, including registered user accounts and citizen reports submitted between 2024 and 2026. The post advertises more than 170,000 reports containing names, email addresses, phone numbers, user roles, report identifiers, case statuses, assigned departments, submission methods, timestamps, internal user IDs, staff details, and descriptions of reported incidents. This claim is currently unverified. 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 30, 2026

🚨 Go-Flare admin panel source code and database allegedly leaked A forum actor claims to have breached Go-Flare, a company specializing in parakites, speedflying and paramotor wings, related equipment, training resources, and community services. The post claims the source code for the company’s online store administration panel and an associated database were stolen and published for download. No details were provided about the number of affected records or the specific information contained in the database. This claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 30, 2026

🚨🇰🇷 Namyang Nexmo database dumps allegedly offered for sale A forum actor claims to be selling fresh database dumps belonging to Namyang Nexmo, a South Korean automotive parts manufacturer formerly known as Namyang Industrial. The seller says the material was taken from company infrastructure rather than its public website. The listing advertises 559 CSV tables totaling 2.51GB and approximately 17.6 million rows. The data allegedly includes employee information, manufacturing records, parts data, customer details, and business partner information. The collection is priced at $40,000. This claim is currently unverified. 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 30, 2026

‼️ New Dark Web Informer Blog Post! Title: Broker Advertises Super Admin Access to Golden Tulip Bahrain FortiGate Firewall Link: https://darkwebinformer.com/broker-advertises-super-admin-access-to-golden-tulip-bahrain-fortigate-firewall/ 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

Dark Web Informer

Broker Advertises Super Admin Access to Golden Tulip Bahrain FortiGate Firewall

A seller posting as Roiese is offering what they describe as full administrative access to the FortiGate firewall and network security environment of Golden Tulip Bahrain, a hotel property in Bahrain.

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 30, 2026

🚨 CVE-2026-67595: VaahCMS 2.0.0-2.3.4 contains malicious obfuscated JavaScript in an OTP email template that can connect to a C2 server, log passwords, scrape WhatsApp Web, and remotely alter pages. Published: 2026-07-29 CVSS 4.0: 9.2 CVSS 3.1: 8.1 Exploitability Score: 2.2 Commit: https://github.com/webreinvent/vaahcms/commit/8d7898f7a385a5fade1180a9b664ff158d873129

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 30, 2026

🚨 Payment card BINs and traffic partner sought for alleged AML drainer campaign A forum actor is seeking a business partner with access to Mastercard cards associated with several specified BINs. The listed BINs are 53526500, 53526504, 53526508, 53526512, 53526516, 53526520, 53526525, 53526529, 53526533, and 53526537. The post also references a casino merchant and seeks a traffic partner for a ready-made campaign involving a landing page equipped with an alleged AML drainer. This claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 30, 2026

🚨🇬🇧 Access to major UK bank allegedly offered for sale A forum actor claims to be selling access to an unidentified organization described as one of the United Kingdom’s largest banks, with approximately $22 billion in revenue. The listing advertises access to the bank’s GitLab and CI/CD environment. No information was provided about the level of access, affected repositories, exposed credentials, or asking price. This claim is currently unverified. 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 30, 2026

🚨 Business and individual lead databases allegedly offered for sale A forum seller is advertising email and contact databases containing records associated with businesses and individuals. The actor claims the information was gathered from credible sources, regularly updated, and can be purchased for randomly selected or specific countries. The advertised records allegedly include email addresses, full names, first and last names, mobile numbers, telecommunications providers, and countries of origin. Pricing starts at $29 for 10,000 records, with 100,000 records offered for $149 and one million records for $500. This claim is currently unverified. 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 30, 2026

🚨 Ling App user database allegedly leaked A forum actor claims to have leaked a complete export belonging to Ling App, a gamified language-learning platform. The listing advertises 5,970,006 deduplicated user profiles spanning 2022 through November 2025, including 2,377,076 profiles with unique email addresses and 166,446 paying subscribers across 238 countries. The data allegedly includes names, email and IP addresses, location details, device identifiers, operating system information, authentication methods, subscription and payment status, transaction identifiers, purchase timestamps, and hundreds of account activity fields covering language progress, study time, streaks, fluency, and onboarding. This claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 30, 2026

🚨🇲🇽 Nayarit State Health System patient database allegedly leaked A forum actor claims to have leaked a database belonging to the Sistema de Salud del Estado de Nayarit, the public healthcare system serving the Mexican state of Nayarit. The post advertises 60,184 patient records in CSV and JSON formats. The data allegedly includes patient identifiers, names, paternal and maternal surnames, sex, CURP identifiers, home addresses, dates of birth, medical record numbers, healthcare services, and affiliation numbers. This claim is currently unverified. 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 30, 2026

🚨🇯🇵 Mama Works user database allegedly offered for sale A forum actor claims to be selling a database belonging to Mama Works, a Japanese employment platform focused on connecting homemakers with flexible work opportunities. The listing advertises 322,537 user records in CSV format for $7,000. Published samples allegedly contain names, names written in kana, email addresses, passwords, gender, dates of birth, ages, postal codes, prefectures, districts, house numbers, residential details, phone numbers, university information, account creation dates, and last login timestamps. This claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 29, 2026

🚨🇲🇽 Locatel citizen records allegedly leaked A forum actor claims to have leaked a dataset belonging to Locatel, a public information and assistance service operating in Mexico. The listing advertises 363,954 citizen records. Published samples allegedly contain names, paternal and maternal surnames, RFC tax identifiers, street addresses, neighborhoods, municipalities, postal codes, phone numbers, gender, email addresses, and internal classification fields. This claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 29, 2026

🚨🇵🇹 CUF customer and contact data allegedly offered for sale A forum actor claims to be selling approximately 263,000 records belonging to CUF, a private healthcare network in Portugal. The advertised dataset is divided into contact records, sample collection instructions, and customer unit information. The data allegedly includes names, Portuguese tax identification numbers, email addresses, phone and fax numbers, physical addresses, dates of birth, gender, customer and unit codes, account details, marketing preferences, assigned representatives, payment methods, collection instructions, timestamps, and internal record identifiers. This claim is currently unverified. 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 29, 2026

🚨 OpenMonero posted an update on the Monero drain they recently went through of approximately 399 XMR. Claiming it was due to a zero-day vulnerability that "had been hiding since the start of the project." Dread: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/0641ad60e064a450aa8a

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 29, 2026

‼️ Analog Devices, Inc. has filed form 8-K due to a Cybersecurity incident https://www.sec.gov/Archives/edgar/data/6281/000119312526324223/d158253d8k.htm "On June 23, 2026, Analog Devices, Inc. (the “Company”) identified unauthorized access to certain Company systems. Following detection of the unauthorized access, the Company immediately activated its incident response protocols and engaged external cybersecurity experts to assist with containment and investigation activities. The Company has also notified and is coordinating with law enforcement authorities. The Company’s operations were not interrupted throughout the duration of the incident. The Company’s investigation has found that certain files were exfiltrated from the affected systems. The Company’s investigation into the nature and scope of the exfiltrated information remains ongoing. To the Company’s knowledge, the data has not been publicly released or used for fraudulent purposes. The Company will continue to monitor for any indication of misuse and will take appropriate action if warranted. The Company will provide notifications to affected parties and applicable regulators as appropriate and in accordance with applicable law. While the Company’s investigation continues, based on information currently known, and the containment and mitigation measures taken, the Company does not believe the June 23, 2026 incident is reasonably likely to materially impact its business, operations, or financial condition. Separately and unrelated, on July 26, 2026, the Company was made aware of public reports regarding a disparate cybersecurity matter and is currently assessing its validity, scope, and any potential impact."

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 29, 2026

Kitty is here to protect you!

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 29, 2026

‼️ New Dark Web Informer Blog Post! Title: Mercor Breached, Biometric Face and Voice Data on Every Registered User Offered for Sale Link: https://darkwebinformer.com/mercor-breached-biometric-face-and-voice-data-on-every-registered-user-offered-for-sale/ 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

Dark Web Informer

Mercor Breached, Biometric Face and Voice Data on Every Registered User Offered for Sale

A seller posting as Resolute, claiming to have acted alongside a group using the Lapsus$ name, is advertising data from a complete compromise of Mercor, the US platform that recruits domain experts to

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 29, 2026

‼️ CVE-2026-43503: DirtyClone is a Linux kernel local privilege escalation (LPE) vulnerability caused by page-cache corruption. PoC: https://github.com/entra1337/DirtyClone

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 29, 2026

‼️ A forum actor claims to be selling a private 0day exploit that bypasses Google Chromes Safe Browsing/malware download alert on macOS, reportedly functional from macOS Monterey through version 27. The exploit is offered for sale at a non-negotiable price of $13,000. 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 29, 2026

‼️ A forum actor is offering for sale a private Windows local privilege escalation exploit claimed to work on versions since 2016 and unaffected by the recent Patch Tuesday update, priced at $145,000 non-negotiable. 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 29, 2026

🚨🇺🇸 Minnesota water systems hit in two-day wave of coordinated OT attacks More than 30 community water systems were targeted on July 26 and 27, triggering a statewide cybersecurity response. Braham’s water plant was temporarily knocked offline after attackers disrupted its computerized operating controls. Other communities reported communications failures or affected automated systems but maintained services through manual procedures and contingency plans. Officials say drinking water remained safe and no statewide changes to water use were required. The attacker, access method, affected equipment, and any potential data theft have not been publicly identified. The FBI, CISA, EPA, and state agencies are assisting with containment and investigation. Source: https://www.bleepingcomputer.com/news/security/hackers-target-over-30-minnesota-water-utilities-in-coordinated-ot-attack/

BleepingComputer

Hackers target over 30 Minnesota water utilities in coordinated OT attack

The Minnesota IT Services (MNIT) agency activated its cybersecurity incident response capabilities across the entire state after hackers targeted more than 30 community water systems in "a coordinated

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 29, 2026

🚨🇺🇸 23 million US clinic patient records allegedly offered for sale A forum actor claims to be selling approximately 23 million patient records obtained from an unidentified clinic in the United States. The actor says the website data was collected in July 2026 and is being sold privately to a single buyer. The advertised data allegedly includes names, dates of birth, gender, addresses, phone numbers, email addresses, postal codes, shipment dates, doctor names, financial responsibility fields, portal data, transaction identifiers, and internal record IDs. The full dataset is priced at $5,000, with smaller batches of one million records offered for $300. This claim is currently unverified. 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 29, 2026

🚨 Access credentials for billion-dollar company allegedly compromised A forum actor claims to possess API keys and remote MySQL connection details belonging to an unidentified company with more than $1 billion in annual revenue. The actor says database access is currently blocked by an IP whitelist. The post seeks assistance from someone with web intrusion and ransomware expertise to access the database and extract customer identification photos and other files stored in an AWS environment. This claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 29, 2026

🚨🇨🇷 Costa Rican identity documents and KYC records allegedly leaked A forum actor claims to have published a large collection of documents linked to individuals in Costa Rica, including identity cards, driver’s licenses, selfies, and know-your-customer records. The post advertises access to as many as 20,000 document sets and includes several sample links. This claim is currently unverified. 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 28, 2026

‼️ New Dark Web Informer Blog Post! Title: Lire Demain Database Allegedly Leaked, 5,974 School and Local Authority Client Records Published Link: https://darkwebinformer.com/lire-demain-database-allegedly-leaked-5-974-school-and-local-authority-client-records-published/ 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

Dark Web Informer

Lire Demain Database Allegedly Leaked, 5,974 School and Local Authority Client Records Published

A forum user posting as 0xSec has published what they describe as the database of Lire Demain, the schools and institutions network of the French children's publisher Auzou, which supplies books, kami

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 28, 2026

‼️ CVE-2026-61511: Improper Neutralization of Directives in Dynamically Evaluated Code FOFA Query: app="vBulletin" FOFA: https://en.fofa.info/result?qbase64=YXBwPSJ2QnVsbGV0aW4i Results: 11,081

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 28, 2026

‼️ New Dark Web Informer Blog Post! Title: Shopee Customer Database Allegedly for Sale, 300 Million Records Claimed Across Asia and Latin America Link: https://darkwebinformer.com/shopee-customer-database-allegedly-for-sale-300-million-records-claimed-across-asia-and-latin-america/ 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

Dark Web Informer

Shopee Customer Database Allegedly for Sale, 300 Million Records Claimed Across Asia and Latin Ameri

A seller posting as 666op is advertising what they describe as a customer database from Shopee, the e-commerce marketplace operated by Sea Limited.

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 28, 2026

XSS is now actively being tracked on the threat feed. Currently the thread view is not native. I pushed a fix and I am waiting for the cycle to complete.

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 28, 2026

🚨🇪🇬 Alfa Coatings ERP database allegedly offered for sale A forum actor claims to be selling a complete ERP database belonging to Alfa Coatings, an Egyptian manufacturer of coatings and chemical products. The alleged SQL export contains 4,345 tables and approximately 2.5GB of raw data covering accounting, human resources, inventory, production, and customer management systems. The listing advertises records for 320 employees, 3,211 B2B customers, 318 suppliers, 4,181 inventory items, 1,103 sales invoices, 629 purchase invoices, 24 ERP users, eight bank accounts, and 194 external contacts. Published samples allegedly include names, corporate email addresses, phone numbers, customer and supplier details, transaction records, bank information, and ERP password hashes. This claim is currently unverified. 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 28, 2026

🚨🇪🇬 Egyptian pharmaceutical manufacturer ERP database allegedly offered for sale A forum actor claims to be selling a complete 20GB production ERP database belonging to an unidentified Egyptian pharmaceutical manufacturer. The alleged Microsoft SQL Server export contains 4,138 tables covering manufacturing, customers, suppliers, finance, and human resources. The listing advertises 19,371 pharmaceutical items, 1,080 chemical formulations, 5,006 production orders, 7,610 customer records, 1,598 supplier records, bank account and payment data, and 3,504 employee records. The actor also claims the database includes transaction histories, credit limits, ingredient quantities, salaries, departments, and account balances of up to EGP 440 million. This claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 28, 2026

🚨🇫🇷 L’Assurance Maladie healthcare provider registry allegedly leaked A forum actor claims to have leaked a 2026 healthcare provider registry associated with L’Assurance Maladie, France’s national health insurance system. The listing advertises more than 9.8 million records in a 1.98GB file, although the thread title claims approximately 12 million records. The data allegedly includes healthcare professional names and identifiers, qualifications, profession codes, medical specialties, workplace and establishment identifiers such as SIRET, SIREN, and FINESS numbers, organization details, addresses, phone numbers, fax numbers, email addresses, administrative classifications, regulatory codes, and professional activity information. This claim is currently unverified. 💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 27, 2026

‼️ New Darknet Market being advertised on Dread called Rampage. Dread Thread: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/7a59f91b957f189d4c12 Dark Web IOC: http://rampagel6own7ds6iwwhnwmfgkkpnwgdl27bruf3johkxpdf4xfsy2yd[.]onion IOC 2: http://ijzibzoxgkwougv7lx43wigora2bbplht3zkzmnqfrspakg5yhjsldyd[.]onion

0

Dark Web Informer

@DarkWebInformer@infosec.exchange · Jul 27, 2026

🚨🇫🇷 Personal information linked to alleged ChatControl supporters leaked A forum actor claims to have published personal information belonging to individuals allegedly involved in supporting or implementing ChatControl, the proposed European Union framework aimed at detecting child sexual abuse material in online communications. A published sample contains a person’s name, date and place of birth, nationality, phone number, email address, home address, and sports club affiliation. This claim is currently unverified. 💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

0

Dark Web Informer

Posts

Vendor Advertises Fraudulently Verified Crypto Exchange Accounts With European Bank Rails

Waggle Database Allegedly Leaked, 106,800+ Pet Camera Customers Exposed Across Three Tables

Hungarian State Treasury Allegedly Compromised, Actor Claims vCenter and Identity Vault Access

Broker Advertises Super Admin Access to Golden Tulip Bahrain FortiGate Firewall

Mercor Breached, Biometric Face and Voice Data on Every Registered User Offered for Sale

Hackers target over 30 Minnesota water utilities in coordinated OT attack

Lire Demain Database Allegedly Leaked, 5,974 School and Local Authority Client Records Published

Shopee Customer Database Allegedly for Sale, 300 Million Records Claimed Across Asia and Latin Ameri

Remote instance

Media