🚨🇹🇷 Denizli Private Egekent Hospital patient data allegedly leaked
A forum actor claims to have leaked a database belonging to Denizli Private Egekent Hospital in Turkey. The post advertises approximately 20,000 patient records and provides a free download link.
The data allegedly includes national identification numbers, names, gender, dates and places of birth, parents’ names, home addresses, visit dates and times, departments, doctors, room numbers, diagnoses, prescription numbers, prescribed medications, treatment fees, payment methods, and insurance provider information.
This claim is currently unverified.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
A forum actor claims to have leaked a database belonging to Denizli Private Egekent Hospital in Turkey. The post advertises approximately 20,000 patient records and provides a free download link.
The data allegedly includes national identification numbers, names, gender, dates and places of birth, parents’ names, home addresses, visit dates and times, departments, doctors, room numbers, diagnoses, prescription numbers, prescribed medications, treatment fees, payment methods, and insurance provider information.
This claim is currently unverified.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
‼️🇮🇩 A forum seller is offering alleged backend access to an Indonesian government system for $200, with escrow support offered for the transaction. No further details on the specific agency or data exposed are provided.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
😭2
🚨 Kyndryl Azure/Entra tenant data allegedly offered for sale
A forum actor claims to be selling an internal data dump belonging to Kyndryl, a global IT infrastructure services company operating across more than 60 countries. The actor says the data was downloaded directly from the company’s Azure/Entra environment using compromised credentials.
The listing advertises more than 170,000 records, including employee accounts, service accounts, administrative roles, display names, email addresses, and other tenant account information.
A sample containing 2,200 records was published alongside the post.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
A forum actor claims to be selling an internal data dump belonging to Kyndryl, a global IT infrastructure services company operating across more than 60 countries. The actor says the data was downloaded directly from the company’s Azure/Entra environment using compromised credentials.
The listing advertises more than 170,000 records, including employee accounts, service accounts, administrative roles, display names, email addresses, and other tenant account information.
A sample containing 2,200 records was published alongside the post.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇮🇶 Qi Mobile ISC customer data allegedly leaked
A forum actor claims to have breached Qi Mobile ISC, an Iraqi mobile telecommunications and digital services provider, and published a 2.03GB uncompressed database containing 970,949 unique customer profiles.
The listing advertises:
• 970,949 unique phone numbers
• 11,168 unique account numbers
• 357,504 unique IP addresses
• Session cookies, JWTs, and JSESSIONIDs
• KYC verification, payment, balance, and CSRF token activity
• Devices, applications, languages, API endpoints, REST paths, and session events
• First and last request, session, and activity timestamps
The actor also exposed an internal IP address and a Telegram bot token associated with the company’s infrastructure.
This claim is currently unverified.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
A forum actor claims to have breached Qi Mobile ISC, an Iraqi mobile telecommunications and digital services provider, and published a 2.03GB uncompressed database containing 970,949 unique customer profiles.
The listing advertises:
• 970,949 unique phone numbers
• 11,168 unique account numbers
• 357,504 unique IP addresses
• Session cookies, JWTs, and JSESSIONIDs
• KYC verification, payment, balance, and CSRF token activity
• Devices, applications, languages, API endpoints, REST paths, and session events
• First and last request, session, and activity timestamps
The actor also exposed an internal IP address and a Telegram bot token associated with the company’s infrastructure.
This claim is currently unverified.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
🚨 PedidosYa customer credentials allegedly leaked
EsqueleSquad claims to have leaked a database associated with PedidosYa, a Latin American food delivery platform operating across multiple countries.
The post advertises more than 9.25 million customer records connected to:
• Argentina
• Bolivia
• Chile
• Ecuador
• Paraguay
• Peru
• Uruguay
• Venezuela
The exposed data allegedly includes:
• Email addresses
• BLAKE3 password hashes
• Home addresses
• Country information
The actor published a database sample and claims the full SQL dump is available for free.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
EsqueleSquad claims to have leaked a database associated with PedidosYa, a Latin American food delivery platform operating across multiple countries.
The post advertises more than 9.25 million customer records connected to:
• Argentina
• Bolivia
• Chile
• Ecuador
• Paraguay
• Peru
• Uruguay
• Venezuela
The exposed data allegedly includes:
• Email addresses
• BLAKE3 password hashes
• Home addresses
• Country information
The actor published a database sample and claims the full SQL dump is available for free.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇫🇷 Xplor Resamania member database allegedly leaked
A forum actor claims to have leaked a database belonging to Xplor Resamania, a fitness and sports club management platform. The post advertises 5,273,884 records linked to users and clubs across France, Switzerland, Belgium, Luxembourg, the United Kingdom, Germany, and Spain.
The exposed data allegedly includes:
• Names and dates of birth
• Email addresses and phone numbers
• Home addresses, cities, and postal codes
• Club names and locations
• Staff and account status fields
• Membership plans, prices, and subscription dates
• Cancellation dates and internal identifiers
This claim is currently unverified.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
A forum actor claims to have leaked a database belonging to Xplor Resamania, a fitness and sports club management platform. The post advertises 5,273,884 records linked to users and clubs across France, Switzerland, Belgium, Luxembourg, the United Kingdom, Germany, and Spain.
The exposed data allegedly includes:
• Names and dates of birth
• Email addresses and phone numbers
• Home addresses, cities, and postal codes
• Club names and locations
• Staff and account status fields
• Membership plans, prices, and subscription dates
• Cancellation dates and internal identifiers
This claim is currently unverified.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
❤1
A 2nd wave of attacks attributed to the Coldcard hacker(s) is ongoing with 1,158.81 BTC stolen from 2,673 addresses...
Thread: https://x.com/glxyresearch/status/2083560940469981591
Thread: https://x.com/glxyresearch/status/2083560940469981591
X (formerly Twitter)
Galaxy Research (@glxyresearch) on X
We identified a 2nd wave of sweeps likely attributed to the same Coldcard hacker as the wave we described in the thread below.
We are now tracking 1,158.81 BTC stolen from 2,673 addresses and hel…
We are now tracking 1,158.81 BTC stolen from 2,673 addresses and hel…
❤1
‼️ A forum actor is offering for sale alleged access to a hospital/patient portal located in the Middle East, priced at $300.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
❤1
🚨🇫🇷 Groupe T2MC HR data and employee documents allegedly leaked
⠀
A forum actor claims to have leaked recruitment and human resources data belonging to Groupe T2MC, a French company specializing in industrial cleaning and reception services.
⠀
The listing advertises 26GB of supporting documents across approximately 82,000 files, including:
⠀
• Names, dates of birth and nationalities
• Addresses, email addresses and phone numbers
• Social Security numbers and employee codes
• Employment status, agencies, managers and applicants
• Contract types, hourly rates and working hours
• Contract dates, absence reasons and replacement details
• Identity cards, bank details and proof-of-address documents
• Health insurance cards, residence permits and work authorizations
• Schedules, purchase orders and internal HR comments
⠀
A sample containing personal and employment information was published alongside the post.
⠀
This claim is currently unverified.
⠀
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
⠀
A forum actor claims to have leaked recruitment and human resources data belonging to Groupe T2MC, a French company specializing in industrial cleaning and reception services.
⠀
The listing advertises 26GB of supporting documents across approximately 82,000 files, including:
⠀
• Names, dates of birth and nationalities
• Addresses, email addresses and phone numbers
• Social Security numbers and employee codes
• Employment status, agencies, managers and applicants
• Contract types, hourly rates and working hours
• Contract dates, absence reasons and replacement details
• Identity cards, bank details and proof-of-address documents
• Health insurance cards, residence permits and work authorizations
• Schedules, purchase orders and internal HR comments
⠀
A sample containing personal and employment information was published alongside the post.
⠀
This claim is currently unverified.
⠀
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
🚨 ICARUS ClickFix malware delivery platform offered for rent
⠀
A forum seller is advertising ICARUS ClickFix, a traffic-management and payload-delivery platform designed to automate ClickFix campaigns while providing centralized control over server-side and client-side operations.
⠀
Advertised capabilities include:
⠀
• Real-time conversion analytics covering views, copied commands, CAPTCHA activity and payload executions
• Filtering by campaign token, country and time range
• Creation of uniquely named traffic streams with globally unique tracking links
• Centralized storage for EXE, DLL and MSI files up to 50MB
• Automated crypting and generation of token-specific executable builds
• Multi-engine AntiTotal scanning every five hours
• WordPress plugin generation that injects operator-controlled scripts through wp_head
• Telegram alerts for command executions and campaign activity
• Automatically generated commands for different integration methods
• A library of customizable CAPTCHA templates
• Real-time editing of visual elements without restarting the platform
• Full masking of plugin names, versions, authors and other metadata
• Configurable plugins designed to appear legitimate to administrators and security tools
• Cloaking intended to hide campaign infrastructure from bots and automated scanners
⠀
Rental pricing is advertised at:
⠀
• One week: $299
• Two weeks: $499
• One month: $799
⠀
The seller also offers temporary access in exchange for a review.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
⠀
A forum seller is advertising ICARUS ClickFix, a traffic-management and payload-delivery platform designed to automate ClickFix campaigns while providing centralized control over server-side and client-side operations.
⠀
Advertised capabilities include:
⠀
• Real-time conversion analytics covering views, copied commands, CAPTCHA activity and payload executions
• Filtering by campaign token, country and time range
• Creation of uniquely named traffic streams with globally unique tracking links
• Centralized storage for EXE, DLL and MSI files up to 50MB
• Automated crypting and generation of token-specific executable builds
• Multi-engine AntiTotal scanning every five hours
• WordPress plugin generation that injects operator-controlled scripts through wp_head
• Telegram alerts for command executions and campaign activity
• Automatically generated commands for different integration methods
• A library of customizable CAPTCHA templates
• Real-time editing of visual elements without restarting the platform
• Full masking of plugin names, versions, authors and other metadata
• Configurable plugins designed to appear legitimate to administrators and security tools
• Cloaking intended to hide campaign infrastructure from bots and automated scanners
⠀
Rental pricing is advertised at:
⠀
• One week: $299
• Two weeks: $499
• One month: $799
⠀
The seller also offers temporary access in exchange for a review.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
❤1😁1
🚨‼️ ShinyHunters claims 3 more victims
🇫🇷 Questel SAS - A Paris-based provider of intellectual-property, innovation-management, and legal software and services. The listing claims more than 21 million Salesforce records containing some PII and over 147 GB of internal corporate data.
🇮🇱 Lumenis Ltd. - An Israeli medical-technology company developing laser, intense-pulsed-light, and radio-frequency systems for aesthetic and vision treatments. The listing claims 1.1 million customer and employee records containing some PII and over 176 GB of internal corporate data.
🇨🇭 Alcon Inc. - A Switzerland-headquartered eye-care company producing surgical equipment, contact lenses, and other vision-care products. The listing claims more than 25 million Salesforce records containing some PII.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
🇫🇷 Questel SAS - A Paris-based provider of intellectual-property, innovation-management, and legal software and services. The listing claims more than 21 million Salesforce records containing some PII and over 147 GB of internal corporate data.
🇮🇱 Lumenis Ltd. - An Israeli medical-technology company developing laser, intense-pulsed-light, and radio-frequency systems for aesthetic and vision treatments. The listing claims 1.1 million customer and employee records containing some PII and over 176 GB of internal corporate data.
🇨🇭 Alcon Inc. - A Switzerland-headquartered eye-care company producing surgical equipment, contact lenses, and other vision-care products. The listing claims more than 25 million Salesforce records containing some PII.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
😈1
🚨🇲🇽 SAIMEX citizen database allegedly leaked
⠀
A forum actor claims to have leaked a database associated with SAIMEX, the State of Mexico’s citizen management and public services platform.
⠀
The post advertises more than 134,000 records linked to government employees, journalists, academics, merchants and other citizens, including:
⠀
• Names and paternal and maternal surnames
• Gender, age range and occupation
• Countries and states of residence
• Street addresses, house numbers and postal codes
• Municipalities and neighborhoods
• Phone numbers and email addresses
• Applicant types and internal record identifiers
⠀
This claim is currently unverified.
⠀
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
⠀
A forum actor claims to have leaked a database associated with SAIMEX, the State of Mexico’s citizen management and public services platform.
⠀
The post advertises more than 134,000 records linked to government employees, journalists, academics, merchants and other citizens, including:
⠀
• Names and paternal and maternal surnames
• Gender, age range and occupation
• Countries and states of residence
• Street addresses, house numbers and postal codes
• Municipalities and neighborhoods
• Phone numbers and email addresses
• Applicant types and internal record identifiers
⠀
This claim is currently unverified.
⠀
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing