π¨πΊπΈ TaxAct user dataset allegedly leaked on a cybercrime forum, 450,000 accounts exposed
β
A forum user claims to have obtained and released a 115 MB dataset containing 450,000 TaxAct user accounts. The poster alleges the data came from a user-account backend and lists the dump date as August 15, 2026.
β
The advertised dataset includes:
β
β’ 450,000 usernames
β’ 449,996 unique email addresses
β’ 347,293 unique U.S. phone numbers
β’ 357,221 email and phone pairs
β’ Account status information
β’ Email and phone verification flags
β’ Last sign-in fields
β’ Internal campaign IDs
β’ Dummy phone number indicators
β
The seller says 146,651 usernames were automatically generated from email addresses. According to the listing, the dump does not contain passwords, Social Security numbers, tax returns or financial information.
β
The poster claims the dataset was obtained through a broader "CredHarvester V6" pipeline and provided samples of individual account records, phone number distributions and email domains.
β
The poster's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum user claims to have obtained and released a 115 MB dataset containing 450,000 TaxAct user accounts. The poster alleges the data came from a user-account backend and lists the dump date as August 15, 2026.
β
The advertised dataset includes:
β
β’ 450,000 usernames
β’ 449,996 unique email addresses
β’ 347,293 unique U.S. phone numbers
β’ 357,221 email and phone pairs
β’ Account status information
β’ Email and phone verification flags
β’ Last sign-in fields
β’ Internal campaign IDs
β’ Dummy phone number indicators
β
The seller says 146,651 usernames were automatically generated from email addresses. According to the listing, the dump does not contain passwords, Social Security numbers, tax returns or financial information.
β
The poster claims the dataset was obtained through a broader "CredHarvester V6" pipeline and provided samples of individual account records, phone number distributions and email domains.
β
The poster's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨πΊπΈ McDonaldβs internal employee dataset allegedly stolen from Azure tenant, 1.7M+ records advertised on a cybercrime forum
β
A forum seller claims to be offering an internal McDonaldβs Corporation employee dataset allegedly downloaded directly from an Azure tenant using compromised credentials. The seller says the dump contains more than 1.7 million records.
β
The advertised data includes:
β
β’ Full names
β’ Employee IDs
β’ Email addresses
β’ Job titles
β’ Departments
β’ Phone numbers
β’ Physical addresses
β’ Employee account records
β’ Service account records
β’ Other tenant account information
β
The seller has published a sample containing approximately 8,000 records and is asking interested buyers to submit offers. The poster also claims to possess additional company datasets available for sale.
β
The seller's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum seller claims to be offering an internal McDonaldβs Corporation employee dataset allegedly downloaded directly from an Azure tenant using compromised credentials. The seller says the dump contains more than 1.7 million records.
β
The advertised data includes:
β
β’ Full names
β’ Employee IDs
β’ Email addresses
β’ Job titles
β’ Departments
β’ Phone numbers
β’ Physical addresses
β’ Employee account records
β’ Service account records
β’ Other tenant account information
β
The seller has published a sample containing approximately 8,000 records and is asking interested buyers to submit offers. The poster also claims to possess additional company datasets available for sale.
β
The seller's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π3π₯1
π¨π«π· FranceCasse customer and order dataset allegedly scraped and leaked on a cybercrime forum
β
A forum user claims to have released a newly obtained dataset from FranceCasse, a French automotive parts platform. The poster says the data was scraped during August 2026 and published samples from multiple files containing customer, address, order and product information.
β
The advertised data includes:
β
β’ Customer names and usernames
β’ Email addresses
β’ Physical addresses and postal codes
β’ Customer account information
β’ Hashed passwords
β’ Order and cart identifiers
β’ Invoice and delivery information
β’ Payment method fields
β’ Order totals and shipping costs
β’ Product IDs and descriptions
β’ Product pricing and inventory information
β’ Vehicle and automotive part information
β’ Manufacturer and supplier fields
β’ Customer and delivery address records
β
The forum post includes samples from files identified as addresses.csv, customers.csv, orders.jsonl and products.jsonl, with the full FranceCasse dataset placed behind hidden forum content.
β
The poster's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum user claims to have released a newly obtained dataset from FranceCasse, a French automotive parts platform. The poster says the data was scraped during August 2026 and published samples from multiple files containing customer, address, order and product information.
β
The advertised data includes:
β
β’ Customer names and usernames
β’ Email addresses
β’ Physical addresses and postal codes
β’ Customer account information
β’ Hashed passwords
β’ Order and cart identifiers
β’ Invoice and delivery information
β’ Payment method fields
β’ Order totals and shipping costs
β’ Product IDs and descriptions
β’ Product pricing and inventory information
β’ Vehicle and automotive part information
β’ Manufacturer and supplier fields
β’ Customer and delivery address records
β
The forum post includes samples from files identified as addresses.csv, customers.csv, orders.jsonl and products.jsonl, with the full FranceCasse dataset placed behind hidden forum content.
β
The poster's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨π«π· Cravero Motoculture dataset allegedly leaked on a cybercrime forum
β
A forum user claims to have leaked a database allegedly belonging to Cravero Motoculture, a French agricultural and outdoor equipment business. The post is labeled as part of the actor's "BlgCloud Leak" series.
β
The advertised leak reportedly contains approximately 3.7 GB of data across 49,168 files.
β
The exposed data shown in the samples includes:
β
β’ Customer and CRM records
β’ Contact names
β’ Email addresses
β’ Phone numbers
β’ Physical addresses
β’ Company and account information
β’ Customer and supplier references
β’ Billing and invoicing fields
β’ Commercial document metadata
β’ PDF sales proposals and other documents
β’ File names, hashes and storage paths
β’ Internal record and attachment identifiers
β
The poster's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum user claims to have leaked a database allegedly belonging to Cravero Motoculture, a French agricultural and outdoor equipment business. The post is labeled as part of the actor's "BlgCloud Leak" series.
β
The advertised leak reportedly contains approximately 3.7 GB of data across 49,168 files.
β
The exposed data shown in the samples includes:
β
β’ Customer and CRM records
β’ Contact names
β’ Email addresses
β’ Phone numbers
β’ Physical addresses
β’ Company and account information
β’ Customer and supplier references
β’ Billing and invoicing fields
β’ Commercial document metadata
β’ PDF sales proposals and other documents
β’ File names, hashes and storage paths
β’ Internal record and attachment identifiers
β
The poster's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨πΊπΈ Gap Inc. internal employee dataset allegedly stolen from Azure tenant, 80K+ records advertised on a cybercrime forum
β
A forum seller claims to be offering an internal Gap Inc. employee dataset allegedly downloaded directly from an Azure tenant using compromised credentials. The seller says the dataset contains more than 80,000 records.
β
The advertised data includes:
β
β’ Full names
β’ Employee IDs
β’ Email addresses
β’ Job titles
β’ Departments
β’ Phone numbers
β’ Physical addresses
β’ Employee account records
β’ Service account records
β’ Other Azure tenant account information
β
The seller has published a sample containing approximately 1,000 records and is asking interested buyers to submit offers. The poster also claims to possess additional company datasets available for sale.
β
The seller's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum seller claims to be offering an internal Gap Inc. employee dataset allegedly downloaded directly from an Azure tenant using compromised credentials. The seller says the dataset contains more than 80,000 records.
β
The advertised data includes:
β
β’ Full names
β’ Employee IDs
β’ Email addresses
β’ Job titles
β’ Departments
β’ Phone numbers
β’ Physical addresses
β’ Employee account records
β’ Service account records
β’ Other Azure tenant account information
β
The seller has published a sample containing approximately 1,000 records and is asking interested buyers to submit offers. The poster also claims to possess additional company datasets available for sale.
β
The seller's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β€2
π¨π°π· South Korea National Health Insurance Service dataset allegedly leaked on a cybercrime forum, 48M records advertised for sale
β
A forum seller claims to be offering a dataset allegedly containing personal and health insurance-related information from South Korea's National Health Insurance Service (NHIS). The seller says the dataset contains approximately 48 million records.
β
The advertised data includes:
β
β’ Names
β’ Resident registration numbers
β’ Gender and dates of birth
β’ Ages
β’ Insurance types
β’ Subscriber classifications
β’ Employer information
β’ Household identifiers
β’ Monthly income information
β’ Monthly insurance premiums
β’ Premium share information
β’ Number of dependents
β’ Regional information
β’ Insurance acquisition dates
β’ Last health checkup dates
β’ Long-term care grades
β’ Payment arrears status
β’ Card status
β’ Data export dates
β
The seller is asking $450 for the dataset and has published sample records in the forum listing.
β
The seller's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum seller claims to be offering a dataset allegedly containing personal and health insurance-related information from South Korea's National Health Insurance Service (NHIS). The seller says the dataset contains approximately 48 million records.
β
The advertised data includes:
β
β’ Names
β’ Resident registration numbers
β’ Gender and dates of birth
β’ Ages
β’ Insurance types
β’ Subscriber classifications
β’ Employer information
β’ Household identifiers
β’ Monthly income information
β’ Monthly insurance premiums
β’ Premium share information
β’ Number of dependents
β’ Regional information
β’ Insurance acquisition dates
β’ Last health checkup dates
β’ Long-term care grades
β’ Payment arrears status
β’ Card status
β’ Data export dates
β
The seller is asking $450 for the dataset and has published sample records in the forum listing.
β
The seller's claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
βΌοΈ SafePal was breached... shocker. https://x.com/DarkWebInformer/status/2089032993650172414
X (formerly Twitter)
Dark Web Informer (@DarkWebInformer) on X
βΌοΈ SafePal was breached... shocker.
π1π1
π¨ Two corporate network accesses advertised for sale on a cybercrime forum
β
A forum seller is advertising access to two companies operating in the business services sector, including one U.S. organization and another described only as being located in the Americas.
β
The first advertised access includes:
β
β’ Approximately $500M in reported revenue
β’ VPN and RDP access
β’ Domain Admin privileges
β’ Windows Defender environment
β’ Approximately 500 hosts
β’ 226 domain-joined machines
β’ 2 domain controllers
β’ More than 1 TB of data
β’ Asking price of $2,000
β
The second advertised access includes:
β
β’ Approximately $10M in reported revenue
β’ VPN access
β’ Standard VPN user privileges
β’ Approximately 120 hosts
β’ 64 domain-joined machines
β’ 4 domain controllers
β’ 8 Microsoft SQL Server systems
β’ Veeam infrastructure identified
β’ Asking price of $200
β
The seller's claims and the authenticity, availability and scope of the advertised corporate access have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum seller is advertising access to two companies operating in the business services sector, including one U.S. organization and another described only as being located in the Americas.
β
The first advertised access includes:
β
β’ Approximately $500M in reported revenue
β’ VPN and RDP access
β’ Domain Admin privileges
β’ Windows Defender environment
β’ Approximately 500 hosts
β’ 226 domain-joined machines
β’ 2 domain controllers
β’ More than 1 TB of data
β’ Asking price of $2,000
β
The second advertised access includes:
β
β’ Approximately $10M in reported revenue
β’ VPN access
β’ Standard VPN user privileges
β’ Approximately 120 hosts
β’ 64 domain-joined machines
β’ 4 domain controllers
β’ 8 Microsoft SQL Server systems
β’ Veeam infrastructure identified
β’ Asking price of $200
β
The seller's claims and the authenticity, availability and scope of the advertised corporate access have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Have I Been Flocked allows you to search your license plate to see if it has been scanned.
https://haveibeenflocked.com/
https://haveibeenflocked.com/
π¨ SafePal customer order data allegedly advertised for sale on a cybercrime forum
β
A forum seller is advertising customer information allegedly connected to a SafePal order plugin data breach. The poster claims the affected records relate to customers who placed orders between March 2, 2025 and April 11, 2026.
β
The advertised data includes:
β
β’ Customer names
β’ Email addresses
β’ Shipping addresses
β’ Phone numbers
β’ Purchase and order details
β’ Country information
β
The seller claims approximately 39,798 customers were affected and says prospective buyers can be provided with order and country information to verify records against SafePal's customer notification system.
β
The listing also references SafePal's published security update concerning unauthorized access to customer order information.
β
The seller's claims and the authenticity, source and scope of the advertised data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum seller is advertising customer information allegedly connected to a SafePal order plugin data breach. The poster claims the affected records relate to customers who placed orders between March 2, 2025 and April 11, 2026.
β
The advertised data includes:
β
β’ Customer names
β’ Email addresses
β’ Shipping addresses
β’ Phone numbers
β’ Purchase and order details
β’ Country information
β
The seller claims approximately 39,798 customers were affected and says prospective buyers can be provided with order and country information to verify records against SafePal's customer notification system.
β
The listing also references SafePal's published security update concerning unauthorized access to customer order information.
β
The seller's claims and the authenticity, source and scope of the advertised data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β€1
βΌοΈ Dread has provided a Quality of Life update.
β’ Invites can now be cancelled
β’ Expired PGP keys no longer block 2FA login codes
β’ Banned users can still view posts and comments, but cannot post or comment
β’ BBCode now supports relative links inside URL blocks
β’ Community Contributor program updated with new moderation tools
β’ Search tokenizer upgraded with better multilingual and natural-language support
β’ Various moderator bugs fixed
β’ Moderator panel pagination fixed
Dread Thread: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/6c4c7d53f97a19b2b928
β’ Invites can now be cancelled
β’ Expired PGP keys no longer block 2FA login codes
β’ Banned users can still view posts and comments, but cannot post or comment
β’ BBCode now supports relative links inside URL blocks
β’ Community Contributor program updated with new moderation tools
β’ Search tokenizer upgraded with better multilingual and natural-language support
β’ Various moderator bugs fixed
β’ Moderator panel pagination fixed
Dread Thread: https://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad[.]onion/post/6c4c7d53f97a19b2b928
β€2
This media is not supported in your browser
VIEW IN TELEGRAM
Get outta my way bitch. π€£
π4π3
This media is not supported in your browser
VIEW IN TELEGRAM
π5β€1π1
π¨π¬π§ Businessmad.com dataset allegedly breached, 1.19M records advertised for sale on a cybercrime forum
β
A forum seller claims to be offering a database allegedly obtained from Businessmad.com, containing 1,199,359 records. The seller dates the dataset to July 2026 and also claims the sale includes Stripe-related keys and live access.
β
The advertised data includes:
β
β’ Names and email addresses
β’ Phone numbers
β’ Physical addresses and postal codes
β’ Company names and registration numbers
β’ Employee and employment information
β’ Job titles, professions and work experience
β’ Account usernames and password fields
β’ Login and signup information
β’ Geographic coordinates and location data
β’ Social media profiles and identifiers
β’ Website and business listing information
β’ Subscription information
β’ Customer consent and verification fields
β’ Invoice payment totals
β’ Past-due and refunded invoice totals
β’ Turnover ranges
β’ Internal IDs, tokens and credential fields
β
The seller is asking $1,000 for the dataset.
β
The seller's claims and the authenticity, source and scope of the allegedly exposed data and access have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A forum seller claims to be offering a database allegedly obtained from Businessmad.com, containing 1,199,359 records. The seller dates the dataset to July 2026 and also claims the sale includes Stripe-related keys and live access.
β
The advertised data includes:
β
β’ Names and email addresses
β’ Phone numbers
β’ Physical addresses and postal codes
β’ Company names and registration numbers
β’ Employee and employment information
β’ Job titles, professions and work experience
β’ Account usernames and password fields
β’ Login and signup information
β’ Geographic coordinates and location data
β’ Social media profiles and identifiers
β’ Website and business listing information
β’ Subscription information
β’ Customer consent and verification fields
β’ Invoice payment totals
β’ Past-due and refunded invoice totals
β’ Turnover ranges
β’ Internal IDs, tokens and credential fields
β
The seller is asking $1,000 for the dataset.
β
The seller's claims and the authenticity, source and scope of the allegedly exposed data and access have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
βΌοΈ New Dark Web Informer Blog Post!
Title: Web3 Casino Intraverse Allegedly Exposed by a Keyless Firebase Database, Including Its Own House Bot Stack
Link: https://darkwebinformer.com/web3-casino-intraverse-allegedly-exposed-by-a-keyless-firebase-database-including-its-own-house-bot-stack/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Title: Web3 Casino Intraverse Allegedly Exposed by a Keyless Firebase Database, Including Its Own House Bot Stack
Link: https://darkwebinformer.com/web3-casino-intraverse-allegedly-exposed-by-a-keyless-firebase-database-including-its-own-house-bot-stack/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Dark Web Informer
Web3 Casino Intraverse Allegedly Exposed by a Keyless Firebase Database, Including Its Own House Bot Stack
A forum user posting as exfilar has published what they describe as the full production Realtime Database behind intraverse.io, the Intraverse/Gamifi web3 gambling platform, totalling 16,898,017 database leaves across roughly 518MB of JSON.
βΌοΈ New Dark Web Informer Blog Post!
Title: Serbian National Health Insurance Databases Allegedly Published Across Multiple File Mirrors
Link: https://darkwebinformer.com/serbian-national-health-insurance-databases-allegedly-published-across-multiple-file-mirrors/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Title: Serbian National Health Insurance Databases Allegedly Published Across Multiple File Mirrors
Link: https://darkwebinformer.com/serbian-national-health-insurance-databases-allegedly-published-across-multiple-file-mirrors/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Dark Web Informer
Serbian National Health Insurance Databases Allegedly Published Across Multiple File Mirrors
A forum user posting as bytetobreach claims to hold databases belonging to RFZO, the Republic Fund for Health Insurance of Serbia, and has posted links to the material across five separate file hosting services.
βΌοΈ New Dark Web Informer Blog Post!
Title: Kenyan Recruitment Platform Snapstartalent Allegedly Dumped With National IDs, Resumes and Recorded Video Interviews
Link: https://darkwebinformer.com/kenyan-recruitment-platform-snapstartalent-allegedly-dumped-with-national-ids-resumes-and-recorded-video-interviews/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Title: Kenyan Recruitment Platform Snapstartalent Allegedly Dumped With National IDs, Resumes and Recorded Video Interviews
Link: https://darkwebinformer.com/kenyan-recruitment-platform-snapstartalent-allegedly-dumped-with-national-ids-resumes-and-recorded-video-interviews/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Dark Web Informer
Kenyan Recruitment Platform Snapstartalent Allegedly Dumped With National IDs, Resumes and Recorded Video Interviews
A forum user posting as exfilar is offering what they describe as a live extraction of the production backend behind Snapstartalent.com, a Kenyan recruitment platform, comprising 176,795 database records and 249GB of downloaded files.
Media is too big
VIEW IN TELEGRAM
βΌοΈ Detection Artifact Generator for Citrix NetScaler CVE-2026-8452
GitHub: https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452
Writeup: https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/
GitHub: https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452
Writeup: https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/