🚨🇫🇷 Xplor Resamania member database allegedly leaked
A forum actor claims to have leaked a database belonging to Xplor Resamania, a fitness and sports club management platform. The post advertises 5,273,884 records linked to users and clubs across France, Switzerland, Belgium, Luxembourg, the United Kingdom, Germany, and Spain.
The exposed data allegedly includes:
• Names and dates of birth
• Email addresses and phone numbers
• Home addresses, cities, and postal codes
• Club names and locations
• Staff and account status fields
• Membership plans, prices, and subscription dates
• Cancellation dates and internal identifiers
This claim is currently unverified.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
A forum actor claims to have leaked a database belonging to Xplor Resamania, a fitness and sports club management platform. The post advertises 5,273,884 records linked to users and clubs across France, Switzerland, Belgium, Luxembourg, the United Kingdom, Germany, and Spain.
The exposed data allegedly includes:
• Names and dates of birth
• Email addresses and phone numbers
• Home addresses, cities, and postal codes
• Club names and locations
• Staff and account status fields
• Membership plans, prices, and subscription dates
• Cancellation dates and internal identifiers
This claim is currently unverified.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
❤1
A 2nd wave of attacks attributed to the Coldcard hacker(s) is ongoing with 1,158.81 BTC stolen from 2,673 addresses...
Thread: https://x.com/glxyresearch/status/2083560940469981591
Thread: https://x.com/glxyresearch/status/2083560940469981591
X (formerly Twitter)
Galaxy Research (@glxyresearch) on X
We identified a 2nd wave of sweeps likely attributed to the same Coldcard hacker as the wave we described in the thread below.
We are now tracking 1,158.81 BTC stolen from 2,673 addresses and hel…
We are now tracking 1,158.81 BTC stolen from 2,673 addresses and hel…
❤1
‼️ A forum actor is offering for sale alleged access to a hospital/patient portal located in the Middle East, priced at $300.
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
❤1
🚨🇫🇷 Groupe T2MC HR data and employee documents allegedly leaked
⠀
A forum actor claims to have leaked recruitment and human resources data belonging to Groupe T2MC, a French company specializing in industrial cleaning and reception services.
⠀
The listing advertises 26GB of supporting documents across approximately 82,000 files, including:
⠀
• Names, dates of birth and nationalities
• Addresses, email addresses and phone numbers
• Social Security numbers and employee codes
• Employment status, agencies, managers and applicants
• Contract types, hourly rates and working hours
• Contract dates, absence reasons and replacement details
• Identity cards, bank details and proof-of-address documents
• Health insurance cards, residence permits and work authorizations
• Schedules, purchase orders and internal HR comments
⠀
A sample containing personal and employment information was published alongside the post.
⠀
This claim is currently unverified.
⠀
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
⠀
A forum actor claims to have leaked recruitment and human resources data belonging to Groupe T2MC, a French company specializing in industrial cleaning and reception services.
⠀
The listing advertises 26GB of supporting documents across approximately 82,000 files, including:
⠀
• Names, dates of birth and nationalities
• Addresses, email addresses and phone numbers
• Social Security numbers and employee codes
• Employment status, agencies, managers and applicants
• Contract types, hourly rates and working hours
• Contract dates, absence reasons and replacement details
• Identity cards, bank details and proof-of-address documents
• Health insurance cards, residence permits and work authorizations
• Schedules, purchase orders and internal HR comments
⠀
A sample containing personal and employment information was published alongside the post.
⠀
This claim is currently unverified.
⠀
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
🚨 ICARUS ClickFix malware delivery platform offered for rent
⠀
A forum seller is advertising ICARUS ClickFix, a traffic-management and payload-delivery platform designed to automate ClickFix campaigns while providing centralized control over server-side and client-side operations.
⠀
Advertised capabilities include:
⠀
• Real-time conversion analytics covering views, copied commands, CAPTCHA activity and payload executions
• Filtering by campaign token, country and time range
• Creation of uniquely named traffic streams with globally unique tracking links
• Centralized storage for EXE, DLL and MSI files up to 50MB
• Automated crypting and generation of token-specific executable builds
• Multi-engine AntiTotal scanning every five hours
• WordPress plugin generation that injects operator-controlled scripts through wp_head
• Telegram alerts for command executions and campaign activity
• Automatically generated commands for different integration methods
• A library of customizable CAPTCHA templates
• Real-time editing of visual elements without restarting the platform
• Full masking of plugin names, versions, authors and other metadata
• Configurable plugins designed to appear legitimate to administrators and security tools
• Cloaking intended to hide campaign infrastructure from bots and automated scanners
⠀
Rental pricing is advertised at:
⠀
• One week: $299
• Two weeks: $499
• One month: $799
⠀
The seller also offers temporary access in exchange for a review.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
⠀
A forum seller is advertising ICARUS ClickFix, a traffic-management and payload-delivery platform designed to automate ClickFix campaigns while providing centralized control over server-side and client-side operations.
⠀
Advertised capabilities include:
⠀
• Real-time conversion analytics covering views, copied commands, CAPTCHA activity and payload executions
• Filtering by campaign token, country and time range
• Creation of uniquely named traffic streams with globally unique tracking links
• Centralized storage for EXE, DLL and MSI files up to 50MB
• Automated crypting and generation of token-specific executable builds
• Multi-engine AntiTotal scanning every five hours
• WordPress plugin generation that injects operator-controlled scripts through wp_head
• Telegram alerts for command executions and campaign activity
• Automatically generated commands for different integration methods
• A library of customizable CAPTCHA templates
• Real-time editing of visual elements without restarting the platform
• Full masking of plugin names, versions, authors and other metadata
• Configurable plugins designed to appear legitimate to administrators and security tools
• Cloaking intended to hide campaign infrastructure from bots and automated scanners
⠀
Rental pricing is advertised at:
⠀
• One week: $299
• Two weeks: $499
• One month: $799
⠀
The seller also offers temporary access in exchange for a review.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
❤1😁1
🚨‼️ ShinyHunters claims 3 more victims
🇫🇷 Questel SAS - A Paris-based provider of intellectual-property, innovation-management, and legal software and services. The listing claims more than 21 million Salesforce records containing some PII and over 147 GB of internal corporate data.
🇮🇱 Lumenis Ltd. - An Israeli medical-technology company developing laser, intense-pulsed-light, and radio-frequency systems for aesthetic and vision treatments. The listing claims 1.1 million customer and employee records containing some PII and over 176 GB of internal corporate data.
🇨🇭 Alcon Inc. - A Switzerland-headquartered eye-care company producing surgical equipment, contact lenses, and other vision-care products. The listing claims more than 25 million Salesforce records containing some PII.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
🇫🇷 Questel SAS - A Paris-based provider of intellectual-property, innovation-management, and legal software and services. The listing claims more than 21 million Salesforce records containing some PII and over 147 GB of internal corporate data.
🇮🇱 Lumenis Ltd. - An Israeli medical-technology company developing laser, intense-pulsed-light, and radio-frequency systems for aesthetic and vision treatments. The listing claims 1.1 million customer and employee records containing some PII and over 176 GB of internal corporate data.
🇨🇭 Alcon Inc. - A Switzerland-headquartered eye-care company producing surgical equipment, contact lenses, and other vision-care products. The listing claims more than 25 million Salesforce records containing some PII.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials
😈1
🚨🇲🇽 SAIMEX citizen database allegedly leaked
⠀
A forum actor claims to have leaked a database associated with SAIMEX, the State of Mexico’s citizen management and public services platform.
⠀
The post advertises more than 134,000 records linked to government employees, journalists, academics, merchants and other citizens, including:
⠀
• Names and paternal and maternal surnames
• Gender, age range and occupation
• Countries and states of residence
• Street addresses, house numbers and postal codes
• Municipalities and neighborhoods
• Phone numbers and email addresses
• Applicant types and internal record identifiers
⠀
This claim is currently unverified.
⠀
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
⠀
A forum actor claims to have leaked a database associated with SAIMEX, the State of Mexico’s citizen management and public services platform.
⠀
The post advertises more than 134,000 records linked to government employees, journalists, academics, merchants and other citizens, including:
⠀
• Names and paternal and maternal surnames
• Gender, age range and occupation
• Countries and states of residence
• Street addresses, house numbers and postal codes
• Municipalities and neighborhoods
• Phone numbers and email addresses
• Applicant types and internal record identifiers
⠀
This claim is currently unverified.
⠀
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
🔪 Slice For Life - Part 2 🔪
Some people really are fucking stupid.
🚨A 3rd wave of attacks on Coldcard-generated addresses is ongoing.
Over $88 million losses are currently estimated.
https://x.com/glxyresearch/status/2083623500183421043
Over $88 million losses are currently estimated.
https://x.com/glxyresearch/status/2083623500183421043
X (formerly Twitter)
Galaxy Research (@glxyresearch) on X
🚨 A 3rd wave in what we suspect are hacks of Coldcard-generated addresses has been identified in which 207.7294 BTC has been drained.
Our estimated observed size of the Coldcard hack is now 1,36…
Our estimated observed size of the Coldcard hack is now 1,36…
😭3😈1
🚨🇺🇸 Wyndham Hotels & Resorts employee data allegedly offered for sale
⠀
A forum actor claims to be selling an internal employee database belonging to Wyndham Hotels & Resorts, allegedly downloaded from the company’s Azure/Entra environment using compromised credentials.
⠀
The listing advertises more than 9,000 records, including:
⠀
• Employee names and corporate email addresses
• Job titles, phone numbers and physical addresses
• Managers and direct-report relationships
• User group memberships and tenant account details
• Employee, service and other organizational accounts
⠀
A sample containing 600 records was published alongside the listing.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
⠀
A forum actor claims to be selling an internal employee database belonging to Wyndham Hotels & Resorts, allegedly downloaded from the company’s Azure/Entra environment using compromised credentials.
⠀
The listing advertises more than 9,000 records, including:
⠀
• Employee names and corporate email addresses
• Job titles, phone numbers and physical addresses
• Managers and direct-report relationships
• User group memberships and tenant account details
• Employee, service and other organizational accounts
⠀
A sample containing 600 records was published alongside the listing.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇬🇧 InterContinental Hotels Group employee data allegedly offered for sale
⠀
A forum actor claims to be selling an internal employee database belonging to InterContinental Hotels Group, allegedly downloaded from the company’s Azure/Entra environment using compromised credentials.
⠀
The listing advertises more than 185,000 records, including:
⠀
• Employee names and corporate email addresses
• Job titles, phone numbers and physical addresses
• Managers and direct-report relationships
• User group memberships and tenant account details
• Employee, service and other organizational accounts
⠀
A sample containing 5,000 records was published alongside the listing.
⠀
This claim is currently unverified.
⠀
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
⠀
A forum actor claims to be selling an internal employee database belonging to InterContinental Hotels Group, allegedly downloaded from the company’s Azure/Entra environment using compromised credentials.
⠀
The listing advertises more than 185,000 records, including:
⠀
• Employee names and corporate email addresses
• Job titles, phone numbers and physical addresses
• Managers and direct-report relationships
• User group memberships and tenant account details
• Employee, service and other organizational accounts
⠀
A sample containing 5,000 records was published alongside the listing.
⠀
This claim is currently unverified.
⠀
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
🚨🇨🇴 Davivienda analytics models and system access allegedly offered for sale
⠀
A forum actor claims to be selling data and system access obtained from a strategic partner of Davivienda, a Colombian financial services company. The listing references Emergia and analytics used to support Davivienda products and customer operations.
⠀
The advertised material allegedly includes:
⠀
• AI and machine-learning analytics models
• Potential-customer database analysis
• Predictive models for Davivienda TMK products
• Digital mobile credit models
• Digital revolving credit models
• Secured digital credit card analytics
• Access to hosts and a monitoring server
• User accounts, roles, creation dates and account statuses
• Real-time access to a system reportedly updated daily
⠀
The seller identifies one model as modelo_davivienda_crm_rot_tdc and claims additional ownership and model information is included. Access is priced at $999 in Monero.
⠀
This claim is currently unverified.
⠀
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
⠀
A forum actor claims to be selling data and system access obtained from a strategic partner of Davivienda, a Colombian financial services company. The listing references Emergia and analytics used to support Davivienda products and customer operations.
⠀
The advertised material allegedly includes:
⠀
• AI and machine-learning analytics models
• Potential-customer database analysis
• Predictive models for Davivienda TMK products
• Digital mobile credit models
• Digital revolving credit models
• Secured digital credit card analytics
• Access to hosts and a monitoring server
• User accounts, roles, creation dates and account statuses
• Real-time access to a system reportedly updated daily
⠀
The seller identifies one model as modelo_davivienda_crm_rot_tdc and claims additional ownership and model information is included. Access is priced at $999 in Monero.
⠀
This claim is currently unverified.
⠀
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
🚨🇷🇺 Moscow Department of Health database allegedly offered for sale
⠀
A forum actor claims to be selling a 2025 database associated with the Moscow Department of Health. The listing advertises approximately 87.85 million rows for $1,000.
⠀
The exposed data allegedly includes:
⠀
• Names, dates of birth, gender and phone numbers
• SNILS identifiers and compulsory medical insurance details
• Passport and other identity document information
• Residential and registration addresses
• Employment and education details
• Medical institution and physician information
• Patient record numbers and preliminary diagnoses
• Illness dates and treatment-related information
• Laboratory orders, specimen collection details and test results
• COVID-19 and other diagnostic testing records
⠀
A sample containing personal, insurance, clinical and laboratory information was published alongside the listing.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
⠀
A forum actor claims to be selling a 2025 database associated with the Moscow Department of Health. The listing advertises approximately 87.85 million rows for $1,000.
⠀
The exposed data allegedly includes:
⠀
• Names, dates of birth, gender and phone numbers
• SNILS identifiers and compulsory medical insurance details
• Passport and other identity document information
• Residential and registration addresses
• Employment and education details
• Medical institution and physician information
• Patient record numbers and preliminary diagnoses
• Illness dates and treatment-related information
• Laboratory orders, specimen collection details and test results
• COVID-19 and other diagnostic testing records
⠀
A sample containing personal, insurance, clinical and laboratory information was published alongside the listing.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇨🇳 Beijing Housing Fund Management Center citizen data allegedly offered for sale
⠀
A forum actor claims to be selling a database associated with the Beijing Housing Fund Management Center, a government-linked housing and financial registry serving formally employed residents of Beijing.
⠀
The listing advertises personal and employment-related information for approximately 17 million residents, including:
⠀
• Names and national identification numbers
• Phone numbers and other contact details
• Employer information
• Housing fund and financial status data
• Additional identity-linked registry information
⠀
A sample was published alongside the listing. The full dataset is priced at $1,700.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
⠀
A forum actor claims to be selling a database associated with the Beijing Housing Fund Management Center, a government-linked housing and financial registry serving formally employed residents of Beijing.
⠀
The listing advertises personal and employment-related information for approximately 17 million residents, including:
⠀
• Names and national identification numbers
• Phone numbers and other contact details
• Employer information
• Housing fund and financial status data
• Additional identity-linked registry information
⠀
A sample was published alongside the listing. The full dataset is priced at $1,700.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇷🇺 WineStyle customer and buyer database allegedly offered for sale
⠀
A forum actor claims to be selling a database belonging to WineStyle, a Russian omnichannel retailer specializing in wine, spirits and other imported alcoholic beverages.
⠀
The listing advertises approximately 1.1 million B2C and B2B buyer records, including:
⠀
• Customer and corporate buyer names
• Email addresses and phone numbers
• Order identifiers
• Complete purchase histories
• Transactional and account-related information
• Location-linked details associated with verified buyers
⠀
The actor claims the database contains active retail and corporate customers and is only available as a complete dataset.
⠀
This claim is currently unverified.
⠀
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing
⠀
A forum actor claims to be selling a database belonging to WineStyle, a Russian omnichannel retailer specializing in wine, spirits and other imported alcoholic beverages.
⠀
The listing advertises approximately 1.1 million B2C and B2B buyer records, including:
⠀
• Customer and corporate buyer names
• Email addresses and phone numbers
• Order identifiers
• Complete purchase histories
• Transactional and account-related information
• Location-linked details associated with verified buyers
⠀
The actor claims the database contains active retail and corporate customers and is only available as a complete dataset.
⠀
This claim is currently unverified.
⠀
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: http://darkwebinformer.com/pricing