🚨🇺🇸 Careficient allegedly breached: 164K patient and staff records exposed from home health EMR software provider
A threat actor claims to have leaked datasets tied to Careficient, a U.S.-based EMR software provider for home health, hospice, and home care management.
━━━━━━━━━━━━━━━━━━━━
Target: Careficient
Sector: Healthcare / EMR Software / Home Health
Incident: Database Leak
Exposure: 164,862 total records
Actor: attacker_company
Country: United States
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Patient dataset containing 163,644 records
▪️ Staff dataset containing 1,218 records
▪️ Patient identity and demographic fields
▪️ Medical reference identifiers and record metadata
▪️ Contact information including email and phone fields
▪️ Address records including city, state, and ZIP code fields
▪️ Staff account metadata and hashed authentication fields
▪️ Organization or agency-related records
Potential impact:
The exposed data could create serious privacy, compliance, phishing, impersonation, and healthcare fraud risks for patients, staff, agencies, and care providers.
Status:
Unverified underground forum claim. The actor posted dataset counts and field categories, with additional content hidden behind forum access.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have leaked datasets tied to Careficient, a U.S.-based EMR software provider for home health, hospice, and home care management.
━━━━━━━━━━━━━━━━━━━━
Target: Careficient
Sector: Healthcare / EMR Software / Home Health
Incident: Database Leak
Exposure: 164,862 total records
Actor: attacker_company
Country: United States
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Patient dataset containing 163,644 records
▪️ Staff dataset containing 1,218 records
▪️ Patient identity and demographic fields
▪️ Medical reference identifiers and record metadata
▪️ Contact information including email and phone fields
▪️ Address records including city, state, and ZIP code fields
▪️ Staff account metadata and hashed authentication fields
▪️ Organization or agency-related records
Potential impact:
The exposed data could create serious privacy, compliance, phishing, impersonation, and healthcare fraud risks for patients, staff, agencies, and care providers.
Status:
Unverified underground forum claim. The actor posted dataset counts and field categories, with additional content hidden behind forum access.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨🇪🇬 Egypt Ministry of Tourism allegedly breached: 547GB employee and hotel-related government data advertised for sale
A threat actor claims to be selling databases allegedly tied to Egypt’s Ministry of Tourism, described in the post as affiliated with the Ministry of Interior.
━━━━━━━━━━━━━━━━━━━━
Target: Egypt Ministry of Tourism
Sector: Government / Tourism / Hospitality
Incident: Data Breach / Data Sale
Exposure: 547GB
Actor: Revesky
Country: Egypt
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Employee records allegedly linked to the Ministry of Tourism and hotel-related entities
▪️ Full names, parent names, job titles, and phone number fields
▪️ National ID and physical address fields
▪️ Hotel names, hotel locations, and governorate data
▪️ Employee profile picture documents
▪️ National ID, educational qualification, birth certificate, and training documents
▪️ Work contract, clearance certificate, legal check, and health certificate documents
Potential impact:
The exposed data could create identity theft, phishing, impersonation, fraud, and government-sector privacy risks for employees, hotels, and tourism-related entities.
Status:
Unverified underground forum sale listing. The actor claims the archive totals 547GB, with document samples and data samples hidden behind forum access.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to be selling databases allegedly tied to Egypt’s Ministry of Tourism, described in the post as affiliated with the Ministry of Interior.
━━━━━━━━━━━━━━━━━━━━
Target: Egypt Ministry of Tourism
Sector: Government / Tourism / Hospitality
Incident: Data Breach / Data Sale
Exposure: 547GB
Actor: Revesky
Country: Egypt
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Employee records allegedly linked to the Ministry of Tourism and hotel-related entities
▪️ Full names, parent names, job titles, and phone number fields
▪️ National ID and physical address fields
▪️ Hotel names, hotel locations, and governorate data
▪️ Employee profile picture documents
▪️ National ID, educational qualification, birth certificate, and training documents
▪️ Work contract, clearance certificate, legal check, and health certificate documents
Potential impact:
The exposed data could create identity theft, phishing, impersonation, fraud, and government-sector privacy risks for employees, hotels, and tourism-related entities.
Status:
Unverified underground forum sale listing. The actor claims the archive totals 547GB, with document samples and data samples hidden behind forum access.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨KRYBIT RaaS advertised: ransomware affiliate program and data extraction tooling promoted on underground forum
A threat actor is advertising KRYBIT RaaS, a ransomware-as-a-service program seeking experienced penetration testing teams to join its partner operation.
━━━━━━━━━━━━━━━━━━━━
Service: KRYBIT RaaS
Sector: Ransomware-as-a-Service / Cybercrime Infrastructure
Incident: RaaS Advertisement
Exposure: Affiliate program, locker tooling, control panel, and data extraction utility
Actor: KRYBIT
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s being advertised:
▪️ Ransomware affiliate program recruiting experienced operators
▪️ Configurable encryption modes and targeting options
▪️ Control panel with build generation and victim communication support
▪️ Windows, Linux, and ESXi tooling referenced by the actor
▪️ Data extraction utility for uploading or transferring stolen files
▪️ Support services marketed around negotiations and victim-facing communications
▪️ Dedicated leak and blog infrastructure shared by the actor
Potential impact:
The advertised service could support enterprise ransomware intrusions, data theft, extortion, operational disruption, and public leak campaigns against targeted organizations.
Status:
Underground forum advertisement. The actor posted Russian and English descriptions of the program, tooling, support model, leak infrastructure, and first-contact details.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor is advertising KRYBIT RaaS, a ransomware-as-a-service program seeking experienced penetration testing teams to join its partner operation.
━━━━━━━━━━━━━━━━━━━━
Service: KRYBIT RaaS
Sector: Ransomware-as-a-Service / Cybercrime Infrastructure
Incident: RaaS Advertisement
Exposure: Affiliate program, locker tooling, control panel, and data extraction utility
Actor: KRYBIT
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s being advertised:
▪️ Ransomware affiliate program recruiting experienced operators
▪️ Configurable encryption modes and targeting options
▪️ Control panel with build generation and victim communication support
▪️ Windows, Linux, and ESXi tooling referenced by the actor
▪️ Data extraction utility for uploading or transferring stolen files
▪️ Support services marketed around negotiations and victim-facing communications
▪️ Dedicated leak and blog infrastructure shared by the actor
Potential impact:
The advertised service could support enterprise ransomware intrusions, data theft, extortion, operational disruption, and public leak campaigns against targeted organizations.
Status:
Underground forum advertisement. The actor posted Russian and English descriptions of the program, tooling, support model, leak infrastructure, and first-contact details.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
It's kind of like Breached wants to get seized at this point...
🚨🇪🇨 VimaSistema allegedly breached: 35GB financial software data exposed across Ecuadorian cooperative records
A threat actor claims to have leaked data tied to VimaSistema, a financial software provider serving savings and credit cooperatives, mutual societies, and pension funds in Ecuador.
━━━━━━━━━━━━━━━━━━━━
Target: VimaSistema / VimaCoop
Sector: Financial Software / Credit Cooperatives
Incident: Data Breach / Multiple Data Leak
Exposure: 35GB+
Actor: tost0n
Country: Ecuador
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Customer and cooperative member records
▪️ Names, identity number fields, and demographic details
▪️ Biometric and fingerprint-related data
▪️ Email, address, and cellphone number fields
▪️ Bank account number and transaction-related records
▪️ Cloud server database files and SQL exports
▪️ Records organized across 2024 and 2025 datasets
▪️ Data tied to multiple Ecuadorian cooperative domains and financial entities
Potential impact:
The exposed data could be used for identity theft, banking fraud, phishing, account impersonation, financial scams, and targeted social engineering against cooperative members and institutions.
Status:
Unverified underground forum claim. The actor posted folder previews and proof-of-concept samples showing structured financial and personal data fields.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have leaked data tied to VimaSistema, a financial software provider serving savings and credit cooperatives, mutual societies, and pension funds in Ecuador.
━━━━━━━━━━━━━━━━━━━━
Target: VimaSistema / VimaCoop
Sector: Financial Software / Credit Cooperatives
Incident: Data Breach / Multiple Data Leak
Exposure: 35GB+
Actor: tost0n
Country: Ecuador
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Customer and cooperative member records
▪️ Names, identity number fields, and demographic details
▪️ Biometric and fingerprint-related data
▪️ Email, address, and cellphone number fields
▪️ Bank account number and transaction-related records
▪️ Cloud server database files and SQL exports
▪️ Records organized across 2024 and 2025 datasets
▪️ Data tied to multiple Ecuadorian cooperative domains and financial entities
Potential impact:
The exposed data could be used for identity theft, banking fraud, phishing, account impersonation, financial scams, and targeted social engineering against cooperative members and institutions.
Status:
Unverified underground forum claim. The actor posted folder previews and proof-of-concept samples showing structured financial and personal data fields.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
❤1
🚨🇫🇷 Gîtes de France allegedly breached: 389K guest and booking records exposed from French holiday rental database
A threat actor claims to have leaked a database tied to Gîtes de France, a French holiday rental network specializing in countryside stays, rural gîtes, and tourist accommodation across France.
━━━━━━━━━━━━━━━━━━━━
Target: Gîtes de France
Sector: Hospitality / Travel / Holiday Rentals
Incident: Database Leak
Exposure: 389,129 people / 312,685 lines / 470MB
Actor: ChimeraZ
Country: France
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Guest and client records allegedly linked to Gîtes de France bookings
▪️ Names, email addresses, and telephone number fields
▪️ Address and accommodation site information
▪️ Booking start and end dates
▪️ Guest count and occupant details
▪️ Stay duration and nightly booking fields
▪️ Tourism tax, price, and agent-related records
▪️ Site log and ticket-related JSON records
Potential impact:
The exposed data could be used for booking impersonation, targeted phishing, travel fraud, customer scams, and social engineering against guests, property owners, and tourism operators.
Status:
Unverified underground forum claim. The actor posted structured JSON samples and claims the archive includes booking, site log, and ticket-related datasets.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to have leaked a database tied to Gîtes de France, a French holiday rental network specializing in countryside stays, rural gîtes, and tourist accommodation across France.
━━━━━━━━━━━━━━━━━━━━
Target: Gîtes de France
Sector: Hospitality / Travel / Holiday Rentals
Incident: Database Leak
Exposure: 389,129 people / 312,685 lines / 470MB
Actor: ChimeraZ
Country: France
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Guest and client records allegedly linked to Gîtes de France bookings
▪️ Names, email addresses, and telephone number fields
▪️ Address and accommodation site information
▪️ Booking start and end dates
▪️ Guest count and occupant details
▪️ Stay duration and nightly booking fields
▪️ Tourism tax, price, and agent-related records
▪️ Site log and ticket-related JSON records
Potential impact:
The exposed data could be used for booking impersonation, targeted phishing, travel fraud, customer scams, and social engineering against guests, property owners, and tourism operators.
Status:
Unverified underground forum claim. The actor posted structured JSON samples and claims the archive includes booking, site log, and ticket-related datasets.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨TLNTrip allegedly breached: 690K travel agency customer and booking records advertised for sale
A threat actor claims to be selling a database tied to TLNTrip, an online travel agency platform used by B2B and B2C customers to book, manage, and issue air tickets, hotels, and holiday packages.
━━━━━━━━━━━━━━━━━━━━
Target: TLNTrip
Sector: Travel / Online Travel Agency / Booking Platform
Incident: Database Leak / Data Sale
Exposure: 690K records
Actor: Sensitive2025
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Customer and lead user records allegedly linked to TLNTrip
▪️ Passenger names, titles, gender, and date-of-birth fields
▪️ Email addresses, phone numbers, and address records
▪️ Passport number, issuing country, and expiration date fields
▪️ Flight booking transaction and ticketing records
▪️ Booking status, payment method, and journey details
▪️ Hotel records including hotel names, addresses, cities, countries, and location metadata
Potential impact:
The exposed data could be used for identity theft, passport fraud, travel booking impersonation, phishing, payment scams, and targeted social engineering against travelers and travel agency customers.
Status:
Unverified underground forum sale listing. The actor posted CSV/SQL samples and claims the database was updated less than three weeks before the listing.
Stop guessing what's redacted. Subscribers see everything → http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to be selling a database tied to TLNTrip, an online travel agency platform used by B2B and B2C customers to book, manage, and issue air tickets, hotels, and holiday packages.
━━━━━━━━━━━━━━━━━━━━
Target: TLNTrip
Sector: Travel / Online Travel Agency / Booking Platform
Incident: Database Leak / Data Sale
Exposure: 690K records
Actor: Sensitive2025
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Customer and lead user records allegedly linked to TLNTrip
▪️ Passenger names, titles, gender, and date-of-birth fields
▪️ Email addresses, phone numbers, and address records
▪️ Passport number, issuing country, and expiration date fields
▪️ Flight booking transaction and ticketing records
▪️ Booking status, payment method, and journey details
▪️ Hotel records including hotel names, addresses, cities, countries, and location metadata
Potential impact:
The exposed data could be used for identity theft, passport fraud, travel booking impersonation, phishing, payment scams, and targeted social engineering against travelers and travel agency customers.
Status:
Unverified underground forum sale listing. The actor posted CSV/SQL samples and claims the database was updated less than three weeks before the listing.
Stop guessing what's redacted. Subscribers see everything → http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
🚨🇦🇪 Dubai Sports Council allegedly breached: 336 internal files advertised for sale from UAE government sports authority
A threat actor claims to be selling a file leak tied to the Dubai Sports Council, the Dubai government entity responsible for developing and regulating the sports sector in the emirate.
━━━━━━━━━━━━━━━━━━━━
Target: Dubai Sports Council
Sector: Government / Sports / Public Administration
Incident: Data Leak / Data Sale
Exposure: 336 files
Actor: hexogenous
Country: United Arab Emirates
Price: $500
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Internal files allegedly linked to Dubai Sports Council operations
▪️ NOCs, permits, approvals, certificates, and licenses
▪️ Event information, schedules, and invitation records
▪️ Marketing material, logos, and public-facing event assets
▪️ Administrative documents related to sports sector activities
▪️ Files connected to clubs, events, programs, and partnerships
Potential impact:
The exposed files could create operational, reputational, phishing, impersonation, and administrative security risks for the council, event partners, clubs, and affiliated organizations.
Status:
Unverified underground forum sale listing. The actor claims the leak contains 336 files and is being offered for $500, negotiable.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations
A threat actor claims to be selling a file leak tied to the Dubai Sports Council, the Dubai government entity responsible for developing and regulating the sports sector in the emirate.
━━━━━━━━━━━━━━━━━━━━
Target: Dubai Sports Council
Sector: Government / Sports / Public Administration
Incident: Data Leak / Data Sale
Exposure: 336 files
Actor: hexogenous
Country: United Arab Emirates
Price: $500
Date: 17/05/2026
━━━━━━━━━━━━━━━━━━━━
What’s allegedly included:
▪️ Internal files allegedly linked to Dubai Sports Council operations
▪️ NOCs, permits, approvals, certificates, and licenses
▪️ Event information, schedules, and invitation records
▪️ Marketing material, logos, and public-facing event assets
▪️ Administrative documents related to sports sector activities
▪️ Files connected to clubs, events, programs, and partnerships
Potential impact:
The exposed files could create operational, reputational, phishing, impersonation, and administrative security risks for the council, event partners, clubs, and affiliated organizations.
Status:
Unverified underground forum sale listing. The actor claims the leak contains 336 files and is being offered for $500, negotiable.
Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations