Cyberattack News Alert
━━━━━━━━━━━━━━━━━━━━━━━━━

Victim: Delano Public Schools
Domain: delano.k12.mn.us

Country: 🇺🇸 US
Date: May 19th, 2026

Summary:
Classes were cancelled in Delano, Minnesota on Wednesday following a cybersecurity incident. The school district indicated that the incident occurred Monday evening and that internet access was cut off immediately after the network was compromised. The district has not confirmed whether this was a cyberattack, but experts are working to identify and resolve the issue.

Source: https://www.cbsnews.com/minnesota/news/delano-schools-closed-cyber-incident/

GitHub confirms they were compromised after an employee device involving a poisoned VS Code extension

https://x.com/github/status/2056949168208552080
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

Cyberattack News Alert
━━━━━━━━━━━━━━━━━━━━━━━━━

Victim: GitHub
Domain: github.com

Country: 🇺🇸 US
Date: May 19th, 2026

Summary:
On May 20, GitHub published the findings of its investigation into an intrusion into its internal repositories, resulting from an attack carried out using a malicious Visual Studio Code (VS Code) extension. The attack targeted an employee's devices the day before, and GitHub took steps to remove the malicious version of the extension and isolate the affected endpoints. The investigation revealed that approximately 3,800 repositories had been compromised, consistent with the scope claimed by the threat actor, the group TeamPCP. To mitigate security risks, GitHub rotated important security keys starting May 19 and plans to continue analyzing system logs and monitoring going forward.

Source: https://www.minsimnews.com/news/articleView.html?idxno=50678

⚠️🇺🇸 LEAK CLAIM / HEALTH INSURANCE

VIP Universal Medical Insurance Group Inc. has been named in a forum sale listing involving an alleged insurance database exposure.

The actor claims the data includes insured members, staff, partners, agents, legal documents, negotiation records, and identity-related files.

[ Details ]

𝗧𝗮𝗿𝗴𝗲𝘁: VIP Universal Medical Insurance Group Inc.
𝗟𝗼𝗰𝗮𝘁𝗶𝗼𝗻: United States
𝗖𝗮𝘁𝗲𝗴𝗼𝗿𝘆: Health Insurance
𝗔𝗰𝘁𝗼𝗿: kalabaz
𝗖𝗹𝗮𝗶𝗺: Database sale
𝗘𝘅𝗽𝗼𝘀𝘂𝗿𝗲: 300K insured + 25K staff/partner/agent records
𝗣𝗿𝗶𝗰𝗲: $400
𝗢𝗯𝘀𝗲𝗿𝘃𝗲𝗱: 19/05/2026

[ Claimed Data ]

• Insured member records
• Staff, partner, and agent records
• Social Security number fields
• Passport document references
• W-9 form references
• Legal and lawsuit-related documents
• Negotiation correspondence
• Database enumeration and exfiltration proof references

[ Verification ]

Unverified underground forum claim. The actor posted multiple proof categories and backup links, while claiming the dataset was exfiltrated from VUMI-related systems.

Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

‼️ LAPSUS$ Group announces a joint for sale post with TeamPCP for the GitHub internal repositories.

TeamPCP launched a for sale post yesterday on a popular cybercrime forum for at least $50,000.
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

⚠️🇨🇴 LEAK CLAIM / HIGHER EDUCATION

Universidad del Quindío has been named in a forum leak post involving an alleged university database exposure.

The actor claims the dump includes emails, passwords, full names, and administrative credentials across multiple university departments.

[ Details ]

𝗧𝗮𝗿𝗴𝗲𝘁: Universidad del Quindío
𝗟𝗼𝗰𝗮𝘁𝗶𝗼𝗻: Colombia
𝗖𝗮𝘁𝗲𝗴𝗼𝗿𝘆: Higher Education
𝗔𝗰𝘁𝗼𝗿: Skull1172
𝗖𝗹𝗮𝗶𝗺: University database leak
𝗘𝘅𝗽𝗼𝘀𝘂𝗿𝗲: 3.26GB
𝗣𝗿𝗶𝗰𝗲: Free
𝗢𝗯𝘀𝗲𝗿𝘃𝗲𝗱: 19/05/2026

[ Claimed Data ]

• Student and staff account records
• Full names and usernames
• University email addresses
• Password fields
• Administrative credentials
• Department-level database records
• JSON-formatted database files

[ Verification ]

Unverified underground forum claim. The actor posted a sample record.

Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

Microsoft acknowledges the YellowKey BitLocker bypass vulnerability and releases mitigations

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45585
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

‼️ New Dark Web Informer Blog Post!

Title: Uruguay DNIC allegedly leaked: 5.8M citizen database records exposed

Link: https://darkwebinformer.com/uruguay-dnic-allegedly-leaked-5-8m-citizen-database-records-exposed/

Cyberattack News Alert
━━━━━━━━━━━━━━━━━━━━━━━━━

Victim: SPLIU
Domain: spliu.pt

Country: 🇵🇷 PR
Date: May 18th, 2026

Summary:
The SPLIU union fell victim to a cyberattack on May 18, the same day it had announced a national strike of early childhood and lower secondary school teachers scheduled for June 15. The attack affected the normal operation of its services, but the union assures that this will not prevent it from continuing its demands for 'absolute equity' in the teaching profession.

Source: https://ovilaverdense.pt/sindicato-denuncia-ataque-informatico-apos-anuncio-de-greve-nacional-de-educadores-e-professores/

I am testing STIX format for API only endpoints. There will be one for the threat feed, ransomware feed and IOC feed. This won't be available on the frontend platform, only for API customers.

I will update when I am close to a date, but I want to say the very end of the month.
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

🚨🇺🇸 Crust Pizza Co. | Alleged Customer Database Sale

Crust Pizza Co. has been named in a forum sale listing involving an alleged customer database exposure.

The actor claims the dataset includes over 523K customer records, including contact details and account-related fields.

[ Details ]

𝗧𝗮𝗿𝗴𝗲𝘁: Crust Pizza Co.
𝗟𝗼𝗰𝗮𝘁𝗶𝗼𝗻: United States
𝗖𝗮𝘁𝗲𝗴𝗼𝗿𝘆: Food & Beverage / Restaurant
𝗔𝗰𝘁𝗼𝗿: Sorb
𝗖𝗹𝗮𝗶𝗺: Customer database sale
𝗘𝘅𝗽𝗼𝘀𝘂𝗿𝗲: 523K customer records
𝗣𝗿𝗶𝗰𝗲: $500
𝗢𝗯𝘀𝗲𝗿𝘃𝗲𝗱: 20/05/2026

[ Claimed Data ]

• Full names
• Email address fields
• Phone number fields
• Account number fields
• Customer ID and store ID fields
• Address, city, state, and ZIP code fields
• CSV-formatted customer database records

[ Verification ]

Unverified underground forum claim. The actor posted a CSV sample and claims the full database is available for sale through escrow.

Stop guessing what's redacted. Subscribers see everything → darkwebinformer.com/pricing
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

‼️ New Dark Web Informer Blog Post!

Title: Perumda Tirta Musi Palembang Alleged Customer Database Sale: 437K+ Utility Records Advertised

Link: https://darkwebinformer.com/perumda-tirta-musi-palembang-alleged-customer-database-sale-437k-utility-records-advertised/