πŸ”ͺ Slice For Life - Part 2 πŸ”ͺ
3.28K subscribers
781 photos
20 videos
596 links
Download Telegram
‼️πŸ‡ͺπŸ‡¬ An Egyptian database containing 1.5 million student records and a 60 million record HR database (37GB total) is allegedly being sold on a hacking forum, exposing extensive PII including ID scans and passport copies.
β €
β€£ Threat Actor: bigF
β€£ Category: Data Sale
β€£ Victim: Undisclosed Egyptian institutions (educational + corporate/government HR)
β€£ Industry: Education / HR / Government
β €
The actor is offering two separate databases in .sql format for sale. The first targets Egyptian university students with extensive PII and identity document scans, while the second is a much larger HR/employment database containing payroll, financial, and authentication data.
β €
What's in it:
β €
First database (~1,000,000 student records):

- Full names (Arabic + English)
- Egyptian National ID numbers
- Date and place of birth
- Home addresses (governorate, city, street)
- Mobile phone numbers and email addresses
- Guardian and university information
- University ID / registration number
- Academic year, faculty, department
- High-res scans of student national IDs
- National ID scans of mother and father
- Visa or passport scans (where available)
β €
Second database (~60M records):

- Persons (full master PII): 456K records
- Personsnationalids: Egyptian National ID numbers + scans
- Personsemp: employment history, job titles, salaries
- Payroll + payrollfrompayroll: direct salary data
- Financialdata + financialdecisions: transactions, approvals
- Auth_user + auth_permission: login credentials + role hashes
- Other tables: ~56M additional records
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
‼️ A new IVR (Interactive Voice Response) 0day automation tool is allegedly being sold on a hacking forum, marketed for high-speed SIP-based attacks against voice menu systems.
β €
β€£ Threat Actor: GENERAL DARK
β€£ Category: Fraud Tool / SIP Abuse
β€£ Product: Ultimate IVR 0DAY
β€£ Industry: Telecom Fraud / Vishing Infrastructure
β €
The actor is advertising a high-throughput IVR manipulation engine designed to bypass standard voice-menu protections, automate digit entry at scale, and process multiple targets per call. The tool is marketed for "stress-testing" but the feature set (DND filtering, auto-authentication, multi-hit batching, response routing) aligns with carding and account-takeover automation against IVR-based banking and customer service systems.
β €
What's advertised:
β €
β–ͺ️ Human-Frame "Barge-In" Mode: interrupts IVR prompts in 50ms to bypass listening delays
β–ͺ️ Ghost Protocol (DTMF Override): switches signal transport mid-call to evade fingerprinting
β–ͺ️ Real-Time Lag Intel: tracks first-response latency to identify high-quality targets
β–ͺ️ Direct-to-Socket RTP: bypasses third-party media servers for raw UDP socket access
β–ͺ️ Smart "Do Not Disturb" filtering to preserve credits
β–ͺ️ Multi-Hit Batching: process 5–20 IDs/products in a single call
β–ͺ️ Intelligent Response Routing via custom JSON logic
β–ͺ️ Auto-Authentication: handles SIP 401/407 challenges automatically
β–ͺ️ High-Volume SIP Stack: thousands of concurrent calls from a single port
β–ͺ️ Parallel Worker Pool: 20 simultaneous calls per session
β–ͺ️ Surgical Timing: 75ms between digits, 100ms tone duration
β–ͺ️ Auto-Retry Engine on dropped calls
β–ͺ️ Live audio analysis (RMS energy detection for human/robot/silence)
β–ͺ️ Structured per-session logs (Product ID, duration, raw response, latency, final status)
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
β€ΌοΈπŸ‡ΊπŸ‡Έ Fund for Teachers (fundforteachers.org), a U.S. nonprofit that provides grants to teachers, has allegedly been breached, with a database containing 51,458 unique user records and grant application data leaked.
β €
β€£ Threat Actor: goyim
β€£ Category: Data Leak
β€£ Victim: Fund for Teachers
β€£ Industry: Nonprofit / Education
β €
The actor states the dataset is limited to teachers and does not contain student information. The nonprofit reportedly claims to have paid out $40 million in total grants. Additional PII is described as easily accessible through other sections of the database beyond what's in the users table.
β €
What's in it:
β €
β–ͺ️ 51,458 unique combined user_id records
β–ͺ️ User IDs and usernames (emails)
β–ͺ️ Bcrypt password hashes
β–ͺ️ Password tokens
β–ͺ️ First and last names
β–ͺ️ Office and cell phone numbers
β–ͺ️ Company, title, full address (street, city, state, zip)
β–ͺ️ Email signatures
β–ͺ️ Role information
β–ͺ️ Grant applications and statuses
β–ͺ️ Various newsletter and email subscription flags
β–ͺ️ Account active/temp status, last search history, modification timestamps
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
β€ΌοΈπŸ‡«πŸ‡· Groupe CGA, a French automotive dealership group, has allegedly been breached, with customer and employee databases offered for sale.
β €
β€£ Threat Actor: DumpsecV2
β€£ Category: Data Leak / Sale
β€£ Victim: Groupe CGA
β€£ Industry: Automotive / Dealerships
β €
The actor (operating under the Dumpsec banner) is publicly denying recent rumors of arrests within their group and announces an upcoming "big event" planned for the summer. The post also contains a personal message directed at an individual named "Christophe Boutry."
β €
What's in it:
β €
β–ͺ️ 65,000 customer records
β–ͺ️ 2,500 employee records
β €
β–ͺ️ Employee data fields:
- GCALD ID, email, first name, last name
- Dealership location
- Internal/external phone numbers
- Mobile numbers
- Group affiliation
β €
β–ͺ️ Customer data fields:
- ID, dealership, customer ID, customer name
- Vehicle make, model, mileage (km)
- Total amount, net total, contract start/end dates, duration
- Vehicle registration number, VIN
- Contract ID and type
- First name, last name, town, postcode, telephone
- GCA Plus status, contract creation/sort timestamps
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
β€ΌοΈπŸ‡¨πŸ‡­ Zurich Insurance has allegedly been breached, with a massive leak containing over 4.26 million insurance contract records and a second file covering insurance policies released for free.
β €
β€£ Threat Actor: NormalLeVrai
β€£ Category: Data Leak
β€£ Victim: Zurich Insurance (zurich.com)
β€£ Industry: Insurance
β €
The actor is releasing two Swiss-related files containing structured insurance data, including detailed contract, policyholder, vehicle, and financial information.
β €
What's in it:
β €
First file (zurich.com.csv): 4,260,757 complete lines of structured insurance data:

- Insurance contracts (policies)
- Clients (policyholders)
- Insured vehicles
- Intermediaries (agents)
- Financial and commercial information
- Coverage details and insured amounts
- Product-specific information (home, business insurance)
- Primary driver and owner data
- Business indicators (status, assistance options, customer value)
β €
Second file (lluch20210629.sql): complete dataset on insurance contracts:

- Policy information: contract number, version, product type, structure, key dates
- Policyholder data: identity (last name, first name), national ID/Tax ID, contact info (address, phone, email)
- Insured vehicle info: registration number, make, model, technical specs (power, engine type, seats)
- Intermediary (agent/broker) info: identifier, name, contact details
- Contractual and financial elements: IBAN, receipt status, insured capital, deductibles, contract terms
- Product-specific data (residential/commercial): property use, dwelling type, business activity
- Linked individuals: primary driver and vehicle owner
- Business indicators: policy status, customer value, up to 10 assistance options
- Additional info: contract language, insurance company, chosen package/plan
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
πŸ”₯1
β€ΌοΈπŸ‡¦πŸ‡ͺ Handala Hack has launched a coordinated attack on the Fujairah Port and other entities in the UAE.
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
❀1
β€ΌοΈπŸ‡«πŸ‡· Bouygues Telecom, one of France's largest telecommunications providers, has allegedly been breached, with an 80.9 GB database being offered for sale by a new threat actor group.
β €
β€£ Threat Actor: OverSec
β€£ Category: Data Sale
β€£ Victim: Bouygues Telecom
β€£ Industry: Telecommunications
β €
The actor introduces themselves as "OverSec" and announces this as their first claim, offering the Bouygues Telecom database obtained on May 1, 2026. Database fields and a sample are distributed via Pastebin links, with proof of access and negotiations available through Session.
β €
What's in it:
β €
β–ͺ️ Total size: 80.9 GB (86,876,683,642 bytes)
β–ͺ️ Format: JSONL
β–ͺ️ Date: May 1, 2026
β–ͺ️ Database fields and sample distributed via Pastebin
β–ͺ️ Contact: Session ID provided
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
Notepad now gaslights you about what you just typed
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
😁4
β€ΌοΈπŸ‡«πŸ‡· La Redoute, a major French e-commerce and home goods retailer, has allegedly been scraped, with a dataset of 96,191 customer expedition (shipment) records leaked.
β €
β€£ Threat Actor: Lagui
β€£ Victim: La Redoute
β€£ Industry: Retail / E-commerce
β €
The actor states the data was scraped a few weeks prior to posting and is completely fresh, never circulated elsewhere. The scrape focuses on shipment/expedition records spanning late 2025 through 2026, including detailed package tracking and delivery event histories.
β €
What's in it:
β €
β–ͺ️ 96,191 complete expedition (shipment) entries
β–ͺ️ Expedition IDs and order numbers
β–ͺ️ Client IDs
β–ͺ️ Customer first names and last names
β–ͺ️ Full addresses, postal codes, cities
β–ͺ️ Phone numbers (multiple per record)
β–ͺ️ Email addresses
β–ͺ️ Package IDs, arrival dates, creation dates
β–ͺ️ Store/enseigne information (e.g., "(01) LA REDOUTE")
β–ͺ️ Delivery type (Relais, Livraison)
β–ͺ️ Order quantities, declared volume and weight
β–ͺ️ Recycling status
β–ͺ️ Detailed event histories: agent names, timestamps, event descriptions, operation dates, package rank and status (e.g., package pickup, retour, livraison confirmation, EDI announcements)
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
β€ΌοΈπŸ‡ΊπŸ‡Έ Johnson & Johnson Innovative Medicine has been claimed a victim to SpaceBears Ransomware
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
‼️ DOJ Press Release
━━━━━━━━━━━━━━━━━━━━━

Member of Prolific Russian Ransomware Group Sentenced to Prison

Full Press Release β†’ justice.gov

━━━━━━━━━━━━━━━━━━━━━
πŸ•΅οΈ Dark Web Informer β€’ DOJ Monitor

Note: DOJ articles that are not Cyber related will be removed manually.