‼️LibrePass allegedly advertised as anonymous company registration, offshore incorporation, and crypto license service operating since 2012

A threat actor operating under the alias LibrePass is selling worldwide company registration, offshore incorporation, and cryptocurrency license services with no background checks or verification required, full nominee service, and anonymity guaranteed.

The service offers shell company setup across more than 60 jurisdictions, including options to open online offices and corporate bank accounts, file annual reports to maintain the companies, and obtain crypto licenses required to legally run exchanges, trading platforms, or purchase Facebook and Twitter ads.

The seller claims to have operated since 2012 with reviews on other forums.

▸ Actor: LibrePass
▸ Sector: Anonymous Incorporation / Offshore / Crypto Licensing
▸ Type: Service Advertisement (money-laundering infrastructure)
▸ Price: From $900 USD for shell companies up to €27,500 for full EU entities, plus crypto licenses from 24,500 to 37,750 EUR
▸ Country: Worldwide (60+ jurisdictions)
▸ Date: 12/05/2026

Service features:

Standard company registration (no verification, nominee service, optional corporate bank account):

▪️ England: $1,250, 2 to 4 days
▪️ Australia: $1,650, 3 to 6 days
▪️ USA (various states): from $2,200, 1 to 5 days
▪️ Hong Kong: $2,300, 3 to 7 days
▪️ Scotland: $900, 2 to 4 days
▪️ Wales: $1,100, 2 to 4 days
▪️ Northern Ireland (GB): $1,500, 2 to 4 days
▪️ Ireland (IE): $5,500, 10 to 15 days
▪️ Canada: $5,200, 10 to 15 days
▪️ New Zealand: $4,500, 2 to 4 days
▪️ Costa Rica: $6,000, 14 to 21 days
▪️ UAE (2 emirates): $12,500, 14 to 21 days
▪️ Singapore: $6,900, 10 to 15 days
▪️ South Africa: $4,200, 10 to 15 days
▪️ Marshall Islands: $5,500, 10 to 15 days
▪️ Panama: $6,200, 14 to 21 days

Europe with authorized capital (processing 2 months or more):

▪️ Luxembourg: €27,500
▪️ Spain: €21,500
▪️ France (SARL): €17,500
▪️ Germany (GmbH): €18,000 + €25,000 minimum authorized capital
▪️ Sweden (A.B.): €15,000 + €25,000 minimum authorized capital
▪️ Romania (SRL): €7,750
▪️ Netherlands (Dutch BV): €21,500
▪️ Liechtenstein: €23,500 + €20,000 minimum share capital
▪️ Switzerland (GmbH): 27,500 CHF + 20,000 CHF minimum share capital

Offshore jurisdictions (no public registry):

▪️ Samoa: 3,500
▪️ Labuan: 11,500
▪️ Vanuatu: 4,500
▪️ Vietnam: 14,000
▪️ Cyprus: 5,500
▪️ Gibraltar: 7,500
▪️ Malta: 7,800
▪️ Anguilla: 3,200
▪️ The Bahamas: 5,800
▪️ Saint Vincent and the Grenadines: 2,800
▪️ Nevis: 4,500
▪️ Mauritius: 9,000
▪️ BVI: 2,700
▪️ Cayman Islands: 6,500
▪️ Seychelles: 2,800

Crypto licenses (company plus license to legally operate exchanges, trading platforms, crypto startups, and purchase ads):

▪️ Poland: €24,500
▪️ Czech Republic: €37,750
▪️ Lithuania: €34,500
▪️ Bulgaria: €28,000
▪️ Georgia: €27,750

US SEC EDGAR registration:

▪️ Includes US company registration, EDGAR filing, and SEC notification
▪️ Timeline: 4 to 5 weeks
▪️ Requires a US company (registration available) plus $25,000
▪️ Guarantor service available at buyer's expense
▪️ EU nominee companies available from $4,500 for corporate account opening

Add-ons and policies:

▪️ +$800 for paid-in authorized capital up to $1 billion
▪️ +$6,500 for full nominee service in some jurisdictions
▪️ Annual report filing and company renewal handled by the seller
▪️ No day-to-day accounting handled

Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

I am testing some new notification features on the threat feed to reduce excessive noise and alert fatigue. These and maybe 1 or 2 more will be available either on Friday or Saturday once I have had enough time to test and resolve some UI and UX issues. Settings continue to save to your localstorage in your browser.

‼️🇬🇷 Municipality of Agrinio allegedly breached: 28 databases exposed via SQL injection on the Greek local government portal

A threat actor is sharing the results of an SQL injection attack against the Municipality of Agrinio, the largest city in the Aetolia-Acarnania regional unit of Western Greece, with a population of approximately 90,000.

Using sqlmap, the actor leveraged boolean-based, error-based, and time-based blind injection techniques on the login form to reach the back-end MySQL database (MySQL ≥ 5.1) running behind a PHP and Apache stack, and enumerated 28 available databases tied to municipal services and elections.

▸ Actor: justscyprus
▸ Sector: Government / Municipal Administration
▸ Type: SQL Injection / Data Breach
▸ Records: 28 enumerated databases
▸ Country: Greece
▸ Date: 13/05/2026

Compromised data:

▪️ Back-end DBMS: MySQL ≥ 5.1
▪️ Web application stack: PHP, Apache
▪️ Injection vector: login form, parameter "username" via POST
▪️ Confirmed injection types: boolean-based blind (WHERE/HAVING), error-based (EXTRACTVALUE), time-based blind (SLEEP)
▪️ Citizen registry database (dimotologio) referenced in the enumeration
▪️ Backup database (mp-agrinio_backup) referenced in the enumeration
▪️ Output logged to local sqlmap output directory under /agrinio.gov.gr/

Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

‼️🇻🇪 Ridery allegedly breached: 11,929 driver records exposed from the leading Venezuelan ride-hailing mobility app

A threat actor is sharing a confidential driver database from Ridery, the leading mobility app in Venezuela launched in 2021 that connects users with certified drivers for rides in cars, motorcycles, or vans across 11 states and 13 cities under a collaborative economy model.

The dump contains 11,929 driver records totaling 4GB compressed, published in JSON format with accompanying JPG driver photos. The sample displays an admin panel view exposing full driver identity records, contact numbers, home addresses in Caracas and surrounding areas, vehicle details, and licence plates.

▸ Actor: malconguerra2 (VIP)
▸ Sector: Mobility / Ride-Hailing
▸ Type: Data Leak
▸ Format: JSON + JPG (4GB compressed)
▸ Records: 11,929 drivers
▸ Country: Venezuela
▸ Date: 13/05/2026

Compromised data:

▪️ Driver full name
▪️ Driver photo (per-driver JPG file)
▪️ Phone number
▪️ Home address (street, building, apartment, district, postal zone, city)
▪️ Vehicle description (e.g., Carro, motorcycle, van)
▪️ Vehicle brand (e.g., Ikco)
▪️ Vehicle model (e.g., Tara, Dena)
▪️ Vehicle licence plate
▪️ Admin panel records ("RYD — Conductores") tied to the driver registry

Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

‼️🇺🇸 McKissock and Colibri Real Estate allegedly breached: 3,395,138 customer records exposed from the US professional licensing education provider with extortion threat

A threat actor claims to have identified an accessible dataset exposing sensitive customer data from McKissock, a US online professional licensing and continuing education provider for real estate, appraisal, and related industries.

The actor states the issue also impacts third-party platforms integrated through shared API infrastructure and partner integrations, with Colibri Real Estate and other affiliated partners using the same backend services confirmed to be affected. The actor warns that the database will be publicly posted via Telegram within 7 days if no agreement is reached.

▸ Actor: deathwatch
▸ Sector: Education / Professional Licensing / Real Estate Training
▸ Type: Data Breach with Extortion Threat
▸ Records: 3,395,138 customer records
▸ Country: United States
▸ Deadline: 7 days from post for an agreement
▸ Date: 13/05/2026

Compromised data:

▪️ Student ID, user name, first name, middle initial, last name, suffix, date of birth
▪️ Email address (primary and alternate)
▪️ Address 1, address 2, city, state
▪️ Daytime phone, evening phone, fax
▪️ NetSuite ID, student type
▪️ Account types including Student Account and Test Account
▪️ Sample entries reference users across Alabama, Pennsylvania, Washington, Virginia, New Mexico, New York, Louisiana, South Dakota, Illinois, Texas, and other US states
▪️ Migration ID, SSN, Driver's License number
▪️ Country, last 4 digits of payment card
▪️ Over 300 employee records containing PII (email, name, age, date of birth, address, relation)
▪️ Payment information for over 500,000+ students including transaction IDs, amount due, and last 4 of the card used
▪️ Thousands of student documents including AAU transcripts, high school transcripts, medical certificates, medical transcripts, real estate certificates, certificates from 2015 through 2021, contact tracker hours, financial records, and UnderSelfAssigned records
▪️ Third-party data shared via API integration with Colibri Real Estate and other affiliated partners

Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations