Cybersecurity Incident Disclosure

Fri, 22 May 2026 16:30:17 EDT
A cybersecurity incident has been disclosed by Oncology Institute, Inc., Inc CIK: 0001799191, Ticker: $TOI.

View SEC Filing

‼️T1erOne forum now has an Onion address:

http://tieronemkfevyizxcnt355agysp2iemvhon6iyclwrc7yuc7oszgzrid[.]onion
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

🚨Keeta Telecom allegedly targeted in telecom system compromise

A threat actor on an underground forum is claiming to have compromised systems allegedly tied to Keeta Telecom.

The actor claims the access includes billing panel activity, call record data, live control functions, SIP routing information, and call surveillance-related records.

𝗪𝗵𝗮𝘁’𝘀 𝗮𝗹𝗹𝗲𝗴𝗲𝗱𝗹𝘆 𝗲𝘅𝗽𝗼𝘀𝗲𝗱:

• Call record database
• Caller and receiver number fields
• Call timing and duration data
• Call status records
• SIP technical route data
• Billing panel access claims
• Live control panel access claims
• Incoming and outgoing call monitoring references

𝗗𝗲𝘁𝗮𝗶𝗹𝘀:

𝗧𝗮𝗿𝗴𝗲𝘁: Keeta Telecom
𝗖𝗼𝘂𝗻𝘁𝗿𝘆: Unknown
𝗦𝗲𝗰𝘁𝗼𝗿: Telecommunications
𝗔𝗰𝘁𝗼𝗿: erresira
𝗖𝗹𝗮𝗶𝗺: Telecom system compromise
𝗘𝘅𝗽𝗼𝘀𝘂𝗿𝗲: 8GB call record database and control panel access claims
𝗣𝗿𝗶𝗰𝗲: Not stated
𝗢𝗯𝘀𝗲𝗿𝘃𝗲𝗱: May 22, 2026

Stop guessing what's redacted. Subscribers see everything: darkwebinformer.com/pricing
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

John Daghita aka "lick" appeared yesterday morning before the indictment chamber of the Court of Appeal in Basse-Terre, where judges wereset to review an extradition request.

The magistrates have reserved their decision until May 28.

John Daghita’s lawyer plans to file a bail request as early as next week for her client, who is currently being held at Basse-Terre prison.

He is accused of stealing $46 million in cryptocurrency from the U.S. federal government.

via Eric Stimpfling (@StimpflingEric)

🚨🇺🇸 ShinyHunters Claims 3 New Victims

🇺🇸 DentaQuest.com: U.S.-based dental benefits administrator and oral health company.

🇺🇸 Charter Communications, Inc.: U.S. telecommunications and cable company best known for Spectrum internet, TV, mobile, and phone services.

🇺🇸 Baker Distributing Company: U.S.-based distributor of HVAC, refrigeration, and foodservice equipment, parts, and supplies.
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

Cyberattack News Alert
━━━━━━━━━━━━━━━━━━━━━━━━━

Victim: Contagem
Domain: contagem.mg.gov.br

Country: 🇧🇷 BR
Date: May 22nd, 2026

Summary:
A cyberattack hit the systems of the Mairie de Contagem (Metropolitan Region of Belo Horizonte) on Friday the 22nd. Although the administration stated that data has been preserved and that no breach occurred, sources indicate that the institutional email accounts of first-tier employees, including Mayor Ricardo Faria, may have been compromised. The municipality temporarily restricted access to ensure system integrity.

Source: https://ofator.com.br/informacao/prefeitura-de-contagem-sofre-ataque-cibernetico/

Cyberattack News Alert
━━━━━━━━━━━━━━━━━━━━━━━━━

Victim: Eyguières
Domain: eyguieres.org

Country: 🇫🇷 FR
Date: May 22nd, 2026

Summary:
The town hall of Eyguières, a small municipality in the Alpilles region, has been the victim of a cyberattack since Friday, May 22. The attack, carried out by the ransomware group known as Qilin, aims to paralyze the electronic system and threatens both municipal data and the personal data of residents. Law enforcement is leading the investigation, however identifying the perpetrators is complicated due to the use of anonymization software.

Source: https://www.ledauphine.com/faits-divers-justice/2026/05/22/la-mairie-du-village-cible-d-une-cyberattaque

‼️ New Dark Web Informer Blog Post!

Title: Pakistani Government Agencies Allegedly Targeted in Multi-Department Personnel Database Leak

Link: https://darkwebinformer.com/pakistani-government-agencies-allegedly-targeted-in-multi-department-personnel-database-leak/

‼️ New Dark Web Informer Blog Post!

Title: WisERP Allegedly Targeted: 1.5M U.S. ERP Customer Records Advertised in Auction

Link: https://darkwebinformer.com/wiserp-allegedly-targeted-1-5m-u-s-erp-customer-records-advertised-in-auction/

🚨🇿🇦 Alleged data breach of South African Revenue Service (SARS) by Nullsec
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

‼️ New Dark Web Informer Blog Post!

Title: Chilean Fire Department System Allegedly Breached: VIPER Platform Records and Internal Documents Exposed

Link: https://darkwebinformer.com/chilean-fire-department-system-allegedly-breached-viper-platform-records-and-internal-documents-exposed/

🚨🇸🇦 Alleged data breach of BinDawood Saudi Arabia exposing 321K customer orders
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

🚨🇺🇸 DentaQuest.com has been removed from ShinyHunters Pay or Leak portal. Seems negotiations are ongoing.
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

Threat Feed export update:

Dashboard exports now apply to your current filtered results instead of full-feed bulk downloads.

This keeps exports useful for things like investigations while helping protect the value of the feed from mass redistribution (you know who you are).🖕

API and STIX access remain unchanged.
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

🚨WhatsApp allegedly targeted in 3 Billion record data leak

A threat actor on an underground forum is claiming to share a large dataset allegedly tied to WhatsApp users.

The actor claims the dataset contains roughly 3B records, with sample rows showing contact, location, and account activity-related fields.

𝗪𝗵𝗮𝘁’𝘀 𝗮𝗹𝗹𝗲𝗴𝗲𝗱𝗹𝘆 𝗲𝘅𝗽𝗼𝘀𝗲𝗱:

• First and last names
• Email address fields
• Cell phone number fields
• WhatsApp active status
• SMS delivery and verification fields
• Date fields
• Address, city, state, and country records
• Postal code fields

𝗗𝗲𝘁𝗮𝗶𝗹𝘀:

𝗧𝗮𝗿𝗴𝗲𝘁: WhatsApp
𝗖𝗼𝘂𝗻𝘁𝗿𝘆: Global
𝗦𝗲𝗰𝘁𝗼𝗿: Messaging / Social Platform / User Data
𝗔𝗰𝘁𝗼𝗿: NormalLeVrai
𝗖𝗹𝗮𝗶𝗺: User database leak
𝗘𝘅𝗽𝗼𝘀𝘂𝗿𝗲: Roughly 3B records
𝗣𝗿𝗶𝗰𝗲: Free
𝗢𝗯𝘀𝗲𝗿𝘃𝗲𝗱: May 23, 2026

Stop guessing what's redacted. Subscribers see everything: darkwebinformer.com/pricing
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

By the way why would you ever say what nationality you are? Unless you are trying to detrace but I don't think that is the case...

‼️ New Dark Web Informer Blog Post!

Title: Optic 2000 Allegedly Targeted: Invoice Files, Franchise Data, and Customer Records Exposed

Link: https://darkwebinformer.com/optic-2000-allegedly-targeted-invoice-files-franchise-data-and-customer-records-exposed/

‼️ New Dark Web Informer Blog Post!

Title: Avea Vacances Allegedly Breached: 46K French Holiday Camp Records Exposed

Link: https://darkwebinformer.com/avea-vacances-allegedly-breached-46k-french-holiday-camp-records-exposed/

🚨Canva allegedly targeted in 7.7M record dataset sale

A threat actor on an underground forum is claiming to sell a dataset allegedly tied to Canva, the online graphic design and visual content platform.

The actor claims the dataset contains 7.7M records and is being sold for $2,000 to one buyer only.

𝗪𝗵𝗮𝘁’𝘀 𝗮𝗹𝗹𝗲𝗴𝗲𝗱𝗹𝘆 𝗲𝘅𝗽𝗼𝘀𝗲𝗱:

• User records
• Email address fields
• Username fields
• Account IDs
• Password hash references
• Registration date fields
• IP address fields
• User status and role metadata
• Forum-style account record samples

𝗗𝗲𝘁𝗮𝗶𝗹𝘀:

𝗧𝗮𝗿𝗴𝗲𝘁: Canva
𝗖𝗼𝘂𝗻𝘁𝗿𝘆: Global
𝗦𝗲𝗰𝘁𝗼𝗿: Design Software / SaaS / User Data
𝗔𝗰𝘁𝗼𝗿: NormalLeVrai
𝗖𝗹𝗮𝗶𝗺: User dataset sale
𝗘𝘅𝗽𝗼𝘀𝘂𝗿𝗲: 7.7M records
𝗣𝗿𝗶𝗰𝗲: $2,000
𝗢𝗯𝘀𝗲𝗿𝘃𝗲𝗱: May 23, 2026

Stop guessing what's redacted. Subscribers see everything: darkwebinformer.com/pricing
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

🚨WhatsApp zero-day exploit allegedly advertised for sale

A threat actor on an underground forum is claiming to sell a WhatsApp zero-day exploit allegedly capable of installing malware or backdoors through private messages.

The actor claims the exploit works on phones and computers and is being sold for $3,000.

𝗪𝗵𝗮𝘁’𝘀 𝗮𝗹𝗹𝗲𝗴𝗲𝗱𝗹𝘆 𝗼𝗳𝗳𝗲𝗿𝗲𝗱:

• WhatsApp zero-day exploit claim
• Private message delivery method
• Malware installation claims
• Backdoor and trojan deployment claims
• Phone and computer targeting claims

𝗗𝗲𝘁𝗮𝗶𝗹𝘀:

𝗧𝗮𝗿𝗴𝗲𝘁: WhatsApp
𝗖𝗼𝘂𝗻𝘁𝗿𝘆: Global
𝗦𝗲𝗰𝘁𝗼𝗿: Messaging / Social Platform
𝗔𝗰𝘁𝗼𝗿: NormalLeVrai
𝗖𝗹𝗮𝗶𝗺: Zero-day exploit sale
𝗘𝘅𝗽𝗼𝘀𝘂𝗿𝗲: Exploit access claim
𝗣𝗿𝗶𝗰𝗲: $3,000
𝗢𝗯𝘀𝗲𝗿𝘃𝗲𝗱: May 23, 2026

Stop guessing what's redacted. Subscribers see everything: darkwebinformer.com/pricing
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations

🚨🇲🇽 INE Sinaloa allegedly targeted in sensitive document leak

A threat actor on an underground forum is claiming to have leaked files allegedly tied to INE Sinaloa in Mexico.

The actor claims the archive includes sensitive documents related to database design, network infrastructure, firewall configuration, manuals, audits, and security camera access.

𝗪𝗵𝗮𝘁’𝘀 𝗮𝗹𝗹𝗲𝗴𝗲𝗱𝗹𝘆 𝗲𝘅𝗽𝗼𝘀𝗲𝗱:

• Database design manuals
• Network infrastructure documents
• Firewall configuration references
• Audit and technical annex documents
• Procurement and proposal files
• Regional INE nomination records
• Navigation and system manuals
• Security camera access claims

𝗗𝗲𝘁𝗮𝗶𝗹𝘀:

𝗧𝗮𝗿𝗴𝗲𝘁: INE Sinaloa
𝗖𝗼𝘂𝗻𝘁𝗿𝘆: Mexico
𝗦𝗲𝗰𝘁𝗼𝗿: Government / Electoral Administration
𝗔𝗰𝘁𝗼𝗿: Z3r00 and MagoSpeak
𝗖𝗹𝗮𝗶𝗺: Sensitive document leak
𝗣𝗿𝗶𝗰𝗲: Free
𝗢𝗯𝘀𝗲𝗿𝘃𝗲𝗱: May 23, 2026

Stop guessing what's redacted. Subscribers see everything: darkwebinformer.com/pricing
________________________________________

Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Website: darkwebinformer.com
Pricing (Includes Crypto): darkwebinformer.com/pricing
API Access: darkwebinformer.com/api-details
Socials: darkwebinformer.com/socials
Donations: darkwebinformer.com/donations