🚨 New Ransomware Group: Sovcali

Found via XSS forum.

Dark Web Onion IOC: http://z3mojpjnxt5tgqvu4wgosihl7pxvrcbyjcgquw2bwkyye5gwbhnf4kqd[.]onion/
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials

🚨🇮🇱 Israel Population and Immigration Authority database allegedly breached
⠀
A forum actor claims to have breached Israel’s Population and Immigration Authority and obtained a 2026 population database containing 9,220,583 records.
⠀
The exposed data allegedly includes:
⠀
• Israeli identification numbers
• First, last and former names
• Gender and marital status
• Full residential addresses
• Phone numbers
• Dates and countries of birth
• Immigration and Aliyah dates
• Death dates and status information
• Parents’ names and identification numbers
• Spouse and family identifiers
• Children and household relationship data
• Additional internal notes and record metadata
⠀
The actor published a 100,000-record sample as proof and claims the complete database is approximately 7.5GB in size. The post also highlights records purportedly associated with prominent Israeli figures.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
________________________________________
Main Channel: https://t.me/SliceForLifeee
Backup Channel: https://t.me/SliceForLifeeee
Telegram CVE Feed: https://t.me/DWI_CVE_Alerts
FBI Watchdog Alerts: https://t.me/FBI_Watchdog
Website: https://darkwebinformer.com
Pricing (Includes Crypto): https://darkwebinformer.com/pricing
API Access: https://darkwebinformer.com/api-details
Socials: https://darkwebinformer.com/socials

🚨🇫🇷 Roussel Agri 62 email, CRM and business documents allegedly leaked
⠀
A forum actor claims to have leaked data belonging to Roussel Agri 62, a French agricultural business. The post is described as the first in a series of alleged leaks connected to BlgCloud.
⠀
The advertised collection includes:
⠀
• 9.33GB of data
• 45,684 files
• 29,127 emails
• 23,816 CRM records
• 45,681 business documents
• Customer and business contact information
• Names, email addresses and phone numbers
• Postal and company addresses
• CRM relationship and account data
• Banking details, including IBAN information
• Orders, invoices and other commercial documents
⠀
The actor published email, CRM and document samples alongside the post.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 BlgCloud breach allegedly exposes data from more than 150 companies
⠀
A forum actor claims to have breached BlgCloud, a French cloud-based ERP and business management platform used by equipment dealers, rental companies, repair businesses and wholesalers.
⠀
The actor claims BlgCloud operates roughly 230 customer instances and that access was obtained to approximately 159 of them.
⠀
The compromised data allegedly includes:
⠀
• Customer and company CRM records
• Business contact information
• Email archives and attachments
• Invoices and commercial documents
• Banking information, including IBAN and BIC fields
• Customer addresses and phone numbers
• Company registration and legal information
• Internal account and user information
• Administrative credentials and configuration data
• Millions of documents across multiple customer environments
⠀
The actor published CRM, email and document samples alongside the post and claims both individual company datasets and the underlying access method are being offered for sale. The group also says it plans to release data from one affected company for free each day.
⠀
The listing describes the total exposure as potentially reaching terabytes of data across the affected BlgCloud customers.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇺🇸 Pokémon Center vending machine data and broader retail SaaS infrastructure allegedly breached
⠀
A forum actor claims to have breached a US-based automated retail SaaS platform used to operate more than 217 smart vending machines and kiosks across 28 brands, including 66 Pokémon Center vending machines. The claim appears to target the underlying SwyftStore / Zoom Systems infrastructure rather than Pokémon directly.
⠀
The actor claims the exposed environment includes:
⠀
• 206,092 unique email addresses
• 70,546 payment card hashes
• 59,797 customer receipts containing masked card numbers
• 8,545 sales transactions with amounts and purchased products
• 217 vending machine locations with inventory and planogram data
• 66 Pokémon Center vending machines
• Customer and administrator PII
• Session and activity logs
• API credentials and backend reporting access
• Firebase databases, storage buckets and related cloud infrastructure
• Source code from three production applications
• 229 original source files
• Product catalogs, pricing, UPCs and SKU information
⠀
The actor claims the affected platform serves 28 brands, with records referencing Pokémon Company International, CVS Pharmacy, Best Buy, Disney, Google, Dollar Shave Club, Juul, Sennheiser, Vera Bradley, Nespresso and others.
⠀
A 1,000-record sample was published alongside the post. The actor is asking $3,000 for the full collection and claims some of the affected cloud services remained accessible when the listing was published.
⠀
This claim is currently unverified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing