π¨πΊπΈ PokΓ©mon Center vending machine data and broader retail SaaS infrastructure allegedly breached
β
A forum actor claims to have breached a US-based automated retail SaaS platform used to operate more than 217 smart vending machines and kiosks across 28 brands, including 66 PokΓ©mon Center vending machines. The claim appears to target the underlying SwyftStore / Zoom Systems infrastructure rather than PokΓ©mon directly.
β
The actor claims the exposed environment includes:
β
β’ 206,092 unique email addresses
β’ 70,546 payment card hashes
β’ 59,797 customer receipts containing masked card numbers
β’ 8,545 sales transactions with amounts and purchased products
β’ 217 vending machine locations with inventory and planogram data
β’ 66 PokΓ©mon Center vending machines
β’ Customer and administrator PII
β’ Session and activity logs
β’ API credentials and backend reporting access
β’ Firebase databases, storage buckets and related cloud infrastructure
β’ Source code from three production applications
β’ 229 original source files
β’ Product catalogs, pricing, UPCs and SKU information
β
The actor claims the affected platform serves 28 brands, with records referencing PokΓ©mon Company International, CVS Pharmacy, Best Buy, Disney, Google, Dollar Shave Club, Juul, Sennheiser, Vera Bradley, Nespresso and others.
β
A 1,000-record sample was published alongside the post. The actor is asking $3,000 for the full collection and claims some of the affected cloud services remained accessible when the listing was published.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to have breached a US-based automated retail SaaS platform used to operate more than 217 smart vending machines and kiosks across 28 brands, including 66 PokΓ©mon Center vending machines. The claim appears to target the underlying SwyftStore / Zoom Systems infrastructure rather than PokΓ©mon directly.
β
The actor claims the exposed environment includes:
β
β’ 206,092 unique email addresses
β’ 70,546 payment card hashes
β’ 59,797 customer receipts containing masked card numbers
β’ 8,545 sales transactions with amounts and purchased products
β’ 217 vending machine locations with inventory and planogram data
β’ 66 PokΓ©mon Center vending machines
β’ Customer and administrator PII
β’ Session and activity logs
β’ API credentials and backend reporting access
β’ Firebase databases, storage buckets and related cloud infrastructure
β’ Source code from three production applications
β’ 229 original source files
β’ Product catalogs, pricing, UPCs and SKU information
β
The actor claims the affected platform serves 28 brands, with records referencing PokΓ©mon Company International, CVS Pharmacy, Best Buy, Disney, Google, Dollar Shave Club, Juul, Sennheiser, Vera Bradley, Nespresso and others.
β
A 1,000-record sample was published alongside the post. The actor is asking $3,000 for the full collection and claims some of the affected cloud services remained accessible when the listing was published.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨ WARDEN Stealer MaaS advertised with 360+ targets, browser theft, crypto grabbing and loader capabilities
β
A threat actor is advertising WARDEN, a malware-as-a-service platform combining an information stealer, grabber, crypto clipper and loader into a single Windows payload reportedly around 350KB in size.
β
The advertised capabilities include:
β
β’ Chromium and Gecko browser data theft across multiple profiles
β’ Passwords, cookies and active session cookies
β’ Stored payment cards, including cardholder and billing information
β’ Google OAuth tokens collected from Chromium-based browsers
β’ Autofill data, browsing history and search history
β’ More than 200 cryptocurrency wallet extensions
β’ More than 360 targeted applications across 13 categories
β’ Cryptocurrency wallets and related applications
β’ Messaging, email and gaming clients
β’ Password managers and 2FA applications
β’ VPN, FTP, RDP and VNC software
β’ Cloud, trading, notes and other applications
β’ Custom file and Windows Registry collection
β’ System information and desktop screenshots
β’ BTC, ETH, TRX, XMR, SOL and TON clipboard replacement
β’ Additional payload execution through an integrated loader
β
WARDEN also advertises infrastructure and evasion features including encrypted data transfer, segmented log delivery, duplicate filtering, automatic gateway failover, anti-VM checks and a code morphing system designed to alter builds between deployments.
β
The operator claims the platform includes a web panel with live log tracking, filtering, markers for high-value accounts, dashboards, Telegram notifications, configurable builds, statistics sharing and an API for higher-tier customers.
β
Three subscription tiers are advertised:
β
β’ Test: $90 per week
β’ Personal: $349 per month
β’ Premium: $499 per month
β
The Premium tier advertises increased build, gateway and log limits along with API access and priority builds. The seller also states that the malware is not intended to operate in CIS or Baltic countries.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A threat actor is advertising WARDEN, a malware-as-a-service platform combining an information stealer, grabber, crypto clipper and loader into a single Windows payload reportedly around 350KB in size.
β
The advertised capabilities include:
β
β’ Chromium and Gecko browser data theft across multiple profiles
β’ Passwords, cookies and active session cookies
β’ Stored payment cards, including cardholder and billing information
β’ Google OAuth tokens collected from Chromium-based browsers
β’ Autofill data, browsing history and search history
β’ More than 200 cryptocurrency wallet extensions
β’ More than 360 targeted applications across 13 categories
β’ Cryptocurrency wallets and related applications
β’ Messaging, email and gaming clients
β’ Password managers and 2FA applications
β’ VPN, FTP, RDP and VNC software
β’ Cloud, trading, notes and other applications
β’ Custom file and Windows Registry collection
β’ System information and desktop screenshots
β’ BTC, ETH, TRX, XMR, SOL and TON clipboard replacement
β’ Additional payload execution through an integrated loader
β
WARDEN also advertises infrastructure and evasion features including encrypted data transfer, segmented log delivery, duplicate filtering, automatic gateway failover, anti-VM checks and a code morphing system designed to alter builds between deployments.
β
The operator claims the platform includes a web panel with live log tracking, filtering, markers for high-value accounts, dashboards, Telegram notifications, configurable builds, statistics sharing and an API for higher-tier customers.
β
Three subscription tiers are advertised:
β
β’ Test: $90 per week
β’ Personal: $349 per month
β’ Premium: $499 per month
β
The Premium tier advertises increased build, gateway and log limits along with API access and priority builds. The seller also states that the malware is not intended to operate in CIS or Baltic countries.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨ Access to unidentified top 10 Asian telecom allegedly offered for sale
β
A forum actor claims to be selling access to a large, publicly traded telecommunications company in Asia with approximately $4 billion in annual revenue.
β
The advertised access allegedly includes:
β
β’ SSH access
β’ Corporate VPN access
β’ Load balancer access
β’ Access to a large internal network
β’ Network mapping information
β
The seller describes the victim as a top 10 telecommunications company in Asia and is asking $500 for the access.
β
The affected company was not publicly identified in the listing.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to be selling access to a large, publicly traded telecommunications company in Asia with approximately $4 billion in annual revenue.
β
The advertised access allegedly includes:
β
β’ SSH access
β’ Corporate VPN access
β’ Load balancer access
β’ Access to a large internal network
β’ Network mapping information
β
The seller describes the victim as a top 10 telecommunications company in Asia and is asking $500 for the access.
β
The affected company was not publicly identified in the listing.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨πΊπΈ DoorDash and T-Mobile insider access allegedly offered on cybercrime forum
β
A forum actor claims to be offering insider services involving employees at DoorDash and T-Mobile, with the ability to retrieve customer information using an email address or phone number.
β
The advertised DoorDash access allegedly includes:
β
β’ Full names
β’ Email addresses and phone numbers
β’ Recent order history
β’ Home addresses
β’ Last four digits of payment cards when available
β
The advertised T-Mobile access allegedly includes:
β
β’ Email addresses and phone numbers
β’ Subscriber names and addresses
β’ Additional lines on the account
β’ Account numbers
β’ Billing amounts and billing dates
β’ ICCID and IMEI numbers
β’ Social Security numbers
β’ Dates of birth
β’ Recent billing information
β
The seller notes that some T-Mobile accounts with SIM protection or advanced account protections may restrict what information can be viewed.
β
The actor is also openly recruiting additional insiders and people with access to corporate systems, including help desk, Okta, Salesforce and similar environments.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to be offering insider services involving employees at DoorDash and T-Mobile, with the ability to retrieve customer information using an email address or phone number.
β
The advertised DoorDash access allegedly includes:
β
β’ Full names
β’ Email addresses and phone numbers
β’ Recent order history
β’ Home addresses
β’ Last four digits of payment cards when available
β
The advertised T-Mobile access allegedly includes:
β
β’ Email addresses and phone numbers
β’ Subscriber names and addresses
β’ Additional lines on the account
β’ Account numbers
β’ Billing amounts and billing dates
β’ ICCID and IMEI numbers
β’ Social Security numbers
β’ Dates of birth
β’ Recent billing information
β
The seller notes that some T-Mobile accounts with SIM protection or advanced account protections may restrict what information can be viewed.
β
The actor is also openly recruiting additional insiders and people with access to corporate systems, including help desk, Okta, Salesforce and similar environments.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨π΅πΎ Crypto investor Harry Yeh found dead outside Paraguay high-rise
Harry Chun Tak Yeh, founder of Quantum Fintech Group, was found dead outside the Jade Park residential complex in AsunciΓ³n after investigators believe "he fell" from around the 30th floor.
Police responding around 4:30 a.m. reportedly found his body outside the building.
Investigators later entered the 30th-floor apartment associated with Yeh and found the doors open and the interior heavily disturbed. Evidence was collected from the apartment, another property linked to him on the 27th floor, and the area outside the building.
Authorities have not determined what caused the fall.
Police and prosecutors are investigating multiple possibilities, including an accident, suicide, or involvement by another person.
An autopsy and review of surveillance footage are expected to help establish what happened.
Source: https://www.kucoin.com/news/flash/chinese-crypto-investor-harry-yeh-found-dead-after-falling-from-30th-floor-in-paraguay
Harry Chun Tak Yeh, founder of Quantum Fintech Group, was found dead outside the Jade Park residential complex in AsunciΓ³n after investigators believe "he fell" from around the 30th floor.
Police responding around 4:30 a.m. reportedly found his body outside the building.
Investigators later entered the 30th-floor apartment associated with Yeh and found the doors open and the interior heavily disturbed. Evidence was collected from the apartment, another property linked to him on the 27th floor, and the area outside the building.
Authorities have not determined what caused the fall.
Police and prosecutors are investigating multiple possibilities, including an accident, suicide, or involvement by another person.
An autopsy and review of surveillance footage are expected to help establish what happened.
Source: https://www.kucoin.com/news/flash/chinese-crypto-investor-harry-yeh-found-dead-after-falling-from-30th-floor-in-paraguay
π1
π¨π«π· Duvignau database leaked in second alleged BlgCloud-related breach
β
A forum actor claims to have leaked data belonging to Duvignau, a French agricultural equipment company, as part of an ongoing series of alleged leaks tied to BlgCloud.
β
The published collection is advertised as approximately 30MB across 24 files and allegedly includes:
β
β’ Customer and CRM records
β’ Names and business contact information
β’ Email addresses and phone numbers
β’ Postal and company addresses
β’ Internal CRM identifiers and account metadata
β’ Email communications
β’ Order and customer correspondence
β’ Commercial documents and PDF attachments
β’ BlgCloud-related support and administrative records
β
The actor published email, CRM and document samples alongside the post and stated that additional BlgCloud customer data will continue to be released.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to have leaked data belonging to Duvignau, a French agricultural equipment company, as part of an ongoing series of alleged leaks tied to BlgCloud.
β
The published collection is advertised as approximately 30MB across 24 files and allegedly includes:
β
β’ Customer and CRM records
β’ Names and business contact information
β’ Email addresses and phone numbers
β’ Postal and company addresses
β’ Internal CRM identifiers and account metadata
β’ Email communications
β’ Order and customer correspondence
β’ Commercial documents and PDF attachments
β’ BlgCloud-related support and administrative records
β
The actor published email, CRM and document samples alongside the post and stated that additional BlgCloud customer data will continue to be released.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨π«π· Bureau VallΓ©e customer database allegedly leaked
A forum actor claims to have breached Bureau VallΓ©e and released a customer database for free after gaining access to an exposed API.
The actor says the access was discovered on July 7, 2026, but disappeared before they could collect the full dataset.
The published collection allegedly contains:
β’ 55,949 customer records
β’ Data stored in a clients.jsonl file
β’ Information collected through the exposed API
β’ Only a partial copy of the accessible customer data
The actor claims the database was released publicly because the original access was no longer available.
This claim is currently unverified.
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
A forum actor claims to have breached Bureau VallΓ©e and released a customer database for free after gaining access to an exposed API.
The actor says the access was discovered on July 7, 2026, but disappeared before they could collect the full dataset.
The published collection allegedly contains:
β’ 55,949 customer records
β’ Data stored in a clients.jsonl file
β’ Information collected through the exposed API
β’ Only a partial copy of the accessible customer data
The actor claims the database was released publicly because the original access was no longer available.
This claim is currently unverified.
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨ Around 13:00 UTC, wallets linked to Coinsbuy were reportedly drained of more than $7.9M across Ethereum and TRON.
h/t: @SpecterAnalyst via his Telegram channel https://t.me/specterinvestigation
The attacker began laundering the stolen funds into Monero (XMR) through exchanges, while ChangeNOW reportedly helped freeze a six-figure amount.
Coinsbuy temporarily paused deposits and withdrawals following the incident, with services now resumed.
Theft addresses:
0x4d1bEF2Fe998B3E3C4029EF9EA6A0534d95661d3
0x66790b54B891e2ebdef58a15B969Ff6fb4374b17
TVpX9xCzrj6KHeNhhDJoqjzEqFMxdgubGR
h/t: @SpecterAnalyst via his Telegram channel https://t.me/specterinvestigation
The attacker began laundering the stolen funds into Monero (XMR) through exchanges, while ChangeNOW reportedly helped freeze a six-figure amount.
Coinsbuy temporarily paused deposits and withdrawals following the incident, with services now resumed.
Theft addresses:
0x4d1bEF2Fe998B3E3C4029EF9EA6A0534d95661d3
0x66790b54B891e2ebdef58a15B969Ff6fb4374b17
TVpX9xCzrj6KHeNhhDJoqjzEqFMxdgubGR
π¨π¨πΎ File upload vulnerability affecting a Cyprus government website allegedly offered for sale
β
A forum actor claims to be selling a file upload vulnerability affecting an unidentified gov[.]cy website in Cyprus. The seller says they also possess credentials to a test account on the affected site.
β
The advertised access allegedly allows:
β
β’ Uploading multiple file types to the government-hosted environment
β’ Creating downloadable links hosted on the government website
β’ Uploading executable, document and archive formats
β’ Using the trusted government domain to distribute uploaded files
β’ Access through an existing test account
β
The seller claims additional proof, including Burp Suite screenshots, will be provided privately to interested buyers.
β
The vulnerability is being offered for between $300 and $750, with the price described as negotiable. The seller says ETH and XMR are accepted.
β
The affected government service was not publicly identified in the listing.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to be selling a file upload vulnerability affecting an unidentified gov[.]cy website in Cyprus. The seller says they also possess credentials to a test account on the affected site.
β
The advertised access allegedly allows:
β
β’ Uploading multiple file types to the government-hosted environment
β’ Creating downloadable links hosted on the government website
β’ Uploading executable, document and archive formats
β’ Using the trusted government domain to distribute uploaded files
β’ Access through an existing test account
β
The seller claims additional proof, including Burp Suite screenshots, will be provided privately to interested buyers.
β
The vulnerability is being offered for between $300 and $750, with the price described as negotiable. The seller says ETH and XMR are accepted.
β
The affected government service was not publicly identified in the listing.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
πͺ Slice For Life - Part 2 πͺ
π¨ ShinyHunters claims an unnamed company as a victim. The listing claims over 11.5 million records across Salesforce, ServiceNow, and Entra containing some customer and employee PII, along with 3.1 TB+ of internal corporate data.
βΌοΈ ShinyHunters has removed this unnamed company from their pay or leak portal. Looks like negotiations are ongoing.
Small update, since I haven't given one in a while. A couple of large legal entities have requested the following, but I haven't committed to them yet.
- Do**ing resources/alert feed (I have always said no in the past to this, but this industry is always changing and I have to keep an open mind while also staying legal)
- A feed that provides updates on shops... if the shop updates, scrape it for an alert.
- More c*rding forums to be tracked
I am also still working on the following:
- 8 forums being added to the threat feed
- Threat Surface Resources list is being completely updated
- Historical threat feed is ongoing
- PoC Explorer is ongoing
- OpSec Failures page is soon
- CVE Trend explorer is ongoing
- Do**ing resources/alert feed (I have always said no in the past to this, but this industry is always changing and I have to keep an open mind while also staying legal)
- A feed that provides updates on shops... if the shop updates, scrape it for an alert.
- More c*rding forums to be tracked
I am also still working on the following:
- 8 forums being added to the threat feed
- Threat Surface Resources list is being completely updated
- Historical threat feed is ongoing
- PoC Explorer is ongoing
- OpSec Failures page is soon
- CVE Trend explorer is ongoing
β€7
π¨ Unidentified PC builder and parts comparison platform with 1.4M users allegedly breached
A forum actor claims to have compromised an unnamed PC building and component comparison service that remains online and active, obtaining extensive access across its production infrastructure, databases, APIs and cloud environments.
The advertised access allegedly includes:
β’ Production MongoDB containing approximately 1.4 million user accounts
β’ Roughly 3 million saved PC builds and 1.3 million render jobs
β’ 148 MongoDB collections with millions of records
β’ Redis access containing approximately 1.6 million keys
β’ Google BigQuery analytics and administrative activity data
β’ A Firebase dataset reportedly containing around 9 million event records
β’ Google Cloud Storage backups, including MongoDB dumps
β’ Approximately 700GB across DigitalOcean Spaces with around 650,000 files
β’ User photos, component images, 3D models and other stored assets
β’ Production REST and tRPC API access
β’ Multiple GCP service accounts and administrative JWT capabilities
β’ DigitalOcean infrastructure and container registry access
β’ SSH access to three MacStadium Mac minis used for rendering
β’ Source code repositories and internal documentation
β’ GitHub organization write access
β’ Discord bot access to a server with roughly 11,000 members
β’ Apple signing and APNs credentials
β’ SendGrid, Gemini, Hugging Face and other third-party API credentials
β’ Affiliate and advertising network credentials
β’ Grafana, Loki and SSH credentials
β’ Related Firebase applications and additional cloud environments
The actor also claims to have already extracted:
β’ 631 completed PC builds
β’ 592 complete user profiles
β’ 6,399 legacy bcrypt password hashes
β’ Approximately 10 staff accounts
The seller states that the compromised infrastructure and copied data are already backed up externally and claims the service remains operational.
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
A forum actor claims to have compromised an unnamed PC building and component comparison service that remains online and active, obtaining extensive access across its production infrastructure, databases, APIs and cloud environments.
The advertised access allegedly includes:
β’ Production MongoDB containing approximately 1.4 million user accounts
β’ Roughly 3 million saved PC builds and 1.3 million render jobs
β’ 148 MongoDB collections with millions of records
β’ Redis access containing approximately 1.6 million keys
β’ Google BigQuery analytics and administrative activity data
β’ A Firebase dataset reportedly containing around 9 million event records
β’ Google Cloud Storage backups, including MongoDB dumps
β’ Approximately 700GB across DigitalOcean Spaces with around 650,000 files
β’ User photos, component images, 3D models and other stored assets
β’ Production REST and tRPC API access
β’ Multiple GCP service accounts and administrative JWT capabilities
β’ DigitalOcean infrastructure and container registry access
β’ SSH access to three MacStadium Mac minis used for rendering
β’ Source code repositories and internal documentation
β’ GitHub organization write access
β’ Discord bot access to a server with roughly 11,000 members
β’ Apple signing and APNs credentials
β’ SendGrid, Gemini, Hugging Face and other third-party API credentials
β’ Affiliate and advertising network credentials
β’ Grafana, Loki and SSH credentials
β’ Related Firebase applications and additional cloud environments
The actor also claims to have already extracted:
β’ 631 completed PC builds
β’ 592 complete user profiles
β’ 6,399 legacy bcrypt password hashes
β’ Approximately 10 staff accounts
The seller states that the compromised infrastructure and copied data are already backed up externally and claims the service remains operational.
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β€3
π¨π§πͺ SQL injection vulnerability affecting Wallonie-Bruxelles Enseignement allegedly offered for sale
β
A forum actor claims to be selling an SQL injection vulnerability affecting Wallonie-Bruxelles Enseignement (WBE), the public education authority serving French-speaking Belgium.
β
The seller claims the vulnerable system supports several SQL injection techniques, including:
β
β’ Boolean-based blind SQL injection
β’ Error-based SQL injection
β’ Inline query injection
β’ Time-based blind SQL injection
β
The actor describes WBE as managing more than 500 schools and approximately 210,000 students.
β
The vulnerability is being offered for $150.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to be selling an SQL injection vulnerability affecting Wallonie-Bruxelles Enseignement (WBE), the public education authority serving French-speaking Belgium.
β
The seller claims the vulnerable system supports several SQL injection techniques, including:
β
β’ Boolean-based blind SQL injection
β’ Error-based SQL injection
β’ Inline query injection
β’ Time-based blind SQL injection
β
The actor describes WBE as managing more than 500 schools and approximately 210,000 students.
β
The vulnerability is being offered for $150.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β€1
π¨ FPFX Tech breach allegedly exposes trader data from 130 proprietary trading firms
β
A forum actor claims to be selling data obtained from FPFX Tech, a software provider that supplies infrastructure and technology to online proprietary trading firms.
β
The actor claims the breach affects approximately 130 prop firms using FPFX Tech and contains 392,000 unique trader records.
β
The exposed data allegedly includes:
β
β’ Full names
β’ Email addresses
β’ Trader account information
β’ Account creation dates
β’ Other personally identifiable information
β’ Records linked to approximately 130 proprietary trading firms
β
The seller published a list of allegedly affected firms along with a 1,000-record sample and is accepting offers for the full dataset.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum actor claims to be selling data obtained from FPFX Tech, a software provider that supplies infrastructure and technology to online proprietary trading firms.
β
The actor claims the breach affects approximately 130 prop firms using FPFX Tech and contains 392,000 unique trader records.
β
The exposed data allegedly includes:
β
β’ Full names
β’ Email addresses
β’ Trader account information
β’ Account creation dates
β’ Other personally identifiable information
β’ Records linked to approximately 130 proprietary trading firms
β
The seller published a list of allegedly affected firms along with a 1,000-record sample and is accepting offers for the full dataset.
β
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing