πͺ Slice For Life - Part 2 πͺ
Dark Matter Market is back online, but maintenance is still ongoing.
Dark Matter is still undergoing maintenance and it will continue for the weekend.
βΌοΈ 12 terabytes of Valve data dating from 2003 to 2013 have just been leaked after reportedly being "hidden" in a public repository.
The archive is said to contain the complete Valve repository, potentially including unreleased prototypes, cut content, development assets, and material that has never been publicly seen before. Early builds of projects such as Half-Life 2: Episode Three could potentially be buried within the files.
The attached image reportedly shows the main menu of a 2009 build of Portal 2.
The community has already begun digging through the massive 12 TB archive to uncover what it contains.
The archive is said to contain the complete Valve repository, potentially including unreleased prototypes, cut content, development assets, and material that has never been publicly seen before. Early builds of projects such as Half-Life 2: Episode Three could potentially be buried within the files.
The attached image reportedly shows the main menu of a 2009 build of Portal 2.
The community has already begun digging through the massive 12 TB archive to uncover what it contains.
π₯3
π¨π¬π§ MKE Engineering Group dataset allegedly leaked on a cybercrime forum, 430GB of data claimed
β
MKE Engineering Group, a UK-based mechanical and electrical engineering services provider headquartered in Sittingbourne, Kent, is allegedly affected by a breach after a threat actor claimed to have exfiltrated approximately 430 GB of company data.
β
The actor claims the exposed material contains approximately 20,000 folders and 450,000 files, with records spanning from the 2000s through 2026.
β
The advertised data includes:
β
β’ Customer and partner information
β’ Employee and contact records
β’ Names and email addresses
β’ Phone numbers
β’ Invoices
β’ Purchase orders
β’ Quotations
β’ Financial information
β’ Engineering tests
β’ Technical drawings
β’ Private communications
β’ Internal datasets
β’ Backups
β’ Job and service documentation
β’ Customer account information
β’ Additional internal business files
β
The forum post includes samples of alleged contact records, invoices, purchase orders, quotations and engineering job documentation as proof of the claimed breach.
β
The actor states the data remained accessible for approximately a week before publication and claims the company had not detected the intrusion during that period.
β
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
MKE Engineering Group, a UK-based mechanical and electrical engineering services provider headquartered in Sittingbourne, Kent, is allegedly affected by a breach after a threat actor claimed to have exfiltrated approximately 430 GB of company data.
β
The actor claims the exposed material contains approximately 20,000 folders and 450,000 files, with records spanning from the 2000s through 2026.
β
The advertised data includes:
β
β’ Customer and partner information
β’ Employee and contact records
β’ Names and email addresses
β’ Phone numbers
β’ Invoices
β’ Purchase orders
β’ Quotations
β’ Financial information
β’ Engineering tests
β’ Technical drawings
β’ Private communications
β’ Internal datasets
β’ Backups
β’ Job and service documentation
β’ Customer account information
β’ Additional internal business files
β
The forum post includes samples of alleged contact records, invoices, purchase orders, quotations and engineering job documentation as proof of the claimed breach.
β
The actor states the data remained accessible for approximately a week before publication and claims the company had not detected the intrusion during that period.
β
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π€2
π¨π«π· Five French fire and rescue services allegedly targeted in data leaks, nearly 20K personnel records claimed
β
A threat actor has published datasets allegedly belonging to five French departmental fire and rescue services (SDIS) across Vosges, Bas-Rhin, Moselle, Gard and Bouches-du-RhΓ΄ne. Combined, the listings claim information associated with approximately 19,952 people across 22,555 records/lines.
β
The affected organizations and claimed figures include:
β
β’ SDIS 88, Vosges: 3,067 people, 4,226 lines, 175 MB CSV
β’ SDIS 67, Bas-Rhin: 3,584 people, 4,423 lines, 5.83 MB JSON
β’ SDIS 57, Moselle: 6,434 people, 6,449 lines, 3.20 MB JSON
β’ SDIS 30, Gard: 3,168 people, 3,757 lines, 300 KB CSV
β’ SDIS 13, Bouches-du-RhΓ΄ne: 3,699 people, 3,700 lines, 635 KB JSON
β
The advertised data across the leaks includes:
β
β’ Personnel names
β’ Employee and personnel IDs
β’ Ranks and job titles
β’ Email addresses
β’ Phone numbers
β’ Fire and rescue center assignments
β’ Groups and departmental affiliations
β’ User and account records
β’ Access rights information
β’ Login and connection records
β’ Internal IP addresses
β’ Password recovery records
β’ Training and course information
β’ Additional internal personnel data
β
The actor published samples and download links for the alleged datasets. The SDIS 67 post also includes several links claimed to provide access to associated Google Drive folders.
β
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
A threat actor has published datasets allegedly belonging to five French departmental fire and rescue services (SDIS) across Vosges, Bas-Rhin, Moselle, Gard and Bouches-du-RhΓ΄ne. Combined, the listings claim information associated with approximately 19,952 people across 22,555 records/lines.
β
The affected organizations and claimed figures include:
β
β’ SDIS 88, Vosges: 3,067 people, 4,226 lines, 175 MB CSV
β’ SDIS 67, Bas-Rhin: 3,584 people, 4,423 lines, 5.83 MB JSON
β’ SDIS 57, Moselle: 6,434 people, 6,449 lines, 3.20 MB JSON
β’ SDIS 30, Gard: 3,168 people, 3,757 lines, 300 KB CSV
β’ SDIS 13, Bouches-du-RhΓ΄ne: 3,699 people, 3,700 lines, 635 KB JSON
β
The advertised data across the leaks includes:
β
β’ Personnel names
β’ Employee and personnel IDs
β’ Ranks and job titles
β’ Email addresses
β’ Phone numbers
β’ Fire and rescue center assignments
β’ Groups and departmental affiliations
β’ User and account records
β’ Access rights information
β’ Login and connection records
β’ Internal IP addresses
β’ Password recovery records
β’ Training and course information
β’ Additional internal personnel data
β
The actor published samples and download links for the alleged datasets. The SDIS 67 post also includes several links claimed to provide access to associated Google Drive folders.
β
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β€1
π¨π«π· DELKO customer dataset allegedly offered for sale on a cybercrime forum, 50K+ customers claimed
β
DELKO, a French automotive maintenance and repair network providing vehicle servicing, mechanical repairs and tire services, is allegedly affected by a data exposure after a threat actor advertised what they claim is the company's complete customer dataset.
β
The actor claims the dataset contains information associated with more than 50,000 customers.
β
The advertised data includes:
β
β’ Customer IDs
β’ First and last names
β’ Email addresses
β’ Phone numbers
β’ Vehicle registration numbers
β’ Account creation dates
β’ Appointment dates
β’ Appointment types
β’ Mechanical service information
β’ Tire service information
β’ Vehicle inspection and maintenance records
β’ Service amounts and pricing fields
β’ Additional service and appointment details
β
The actor published samples of the alleged customer records along with images presented as proof of access.
β
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
DELKO, a French automotive maintenance and repair network providing vehicle servicing, mechanical repairs and tire services, is allegedly affected by a data exposure after a threat actor advertised what they claim is the company's complete customer dataset.
β
The actor claims the dataset contains information associated with more than 50,000 customers.
β
The advertised data includes:
β
β’ Customer IDs
β’ First and last names
β’ Email addresses
β’ Phone numbers
β’ Vehicle registration numbers
β’ Account creation dates
β’ Appointment dates
β’ Appointment types
β’ Mechanical service information
β’ Tire service information
β’ Vehicle inspection and maintenance records
β’ Service amounts and pricing fields
β’ Additional service and appointment details
β
The actor published samples of the alleged customer records along with images presented as proof of access.
β
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨π«π· Courir internal infrastructure allegedly compromised, persistent access offered for sale on a cybercrime forum by LAPSUS$ Group.
β
Courir, a French footwear and sneaker retailer, is allegedly affected by a significant security breach after a threat actor claimed to have compromised multiple segments of the company's production and development infrastructure.
β
The actor claims the intrusion followed a multi-week operation in which internal systems were mapped, compromised and data was exfiltrated. The group is now advertising what it describes as exclusive access packages to Courir's environment.
β
The advertised access includes:
β
β’ Internal developer panels
β’ Full administrative control over development portals
β’ Internal management interfaces
β’ High-privilege service accounts
β’ Alternative internal access points
β’ Persistent footholds across multiple infrastructure segments
β’ Internal routing pathways
β’ Claimed lateral movement across corporate environments
β’ Access to production and development systems
β
The post includes multiple screenshots presented as proof of access and attributes the alleged compromise to a member of the group operating under the name 3xpl0rat0r.
β
No public asking price is provided, with prospective buyers directed to negotiate privately.
β
The claims and the authenticity, scope and current validity of the allegedly compromised access have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
Courir, a French footwear and sneaker retailer, is allegedly affected by a significant security breach after a threat actor claimed to have compromised multiple segments of the company's production and development infrastructure.
β
The actor claims the intrusion followed a multi-week operation in which internal systems were mapped, compromised and data was exfiltrated. The group is now advertising what it describes as exclusive access packages to Courir's environment.
β
The advertised access includes:
β
β’ Internal developer panels
β’ Full administrative control over development portals
β’ Internal management interfaces
β’ High-privilege service accounts
β’ Alternative internal access points
β’ Persistent footholds across multiple infrastructure segments
β’ Internal routing pathways
β’ Claimed lateral movement across corporate environments
β’ Access to production and development systems
β
The post includes multiple screenshots presented as proof of access and attributes the alleged compromise to a member of the group operating under the name 3xpl0rat0r.
β
No public asking price is provided, with prospective buyers directed to negotiate privately.
β
The claims and the authenticity, scope and current validity of the allegedly compromised access have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
βΌοΈπ¦πΉπΉπ·π¨π± DireWolf Ransomware claims a well known video game publisher and 2 hospitals
π¦πΉ THQ Nordic - An Austrian video game publisher and developer based in Vienna, known for franchises including Darksiders, Destroy All Humans!, and SpongeBob SquarePants titles. The listing claims 335 GB of data.
πΉπ· Erdem Hospital - A Turkish private healthcare provider operating hospitals and medical facilities offering a range of diagnostic, surgical, and specialist services. The listing claims 260 GB of data.
π¨π± Hospital ClΓnico Universidad de Chile - A major university teaching hospital in Santiago affiliated with the University of Chile, providing specialized medical care, education, and clinical research. The listing claims 240 GB of data.
π¦πΉ THQ Nordic - An Austrian video game publisher and developer based in Vienna, known for franchises including Darksiders, Destroy All Humans!, and SpongeBob SquarePants titles. The listing claims 335 GB of data.
πΉπ· Erdem Hospital - A Turkish private healthcare provider operating hospitals and medical facilities offering a range of diagnostic, surgical, and specialist services. The listing claims 260 GB of data.
π¨π± Hospital ClΓnico Universidad de Chile - A major university teaching hospital in Santiago affiliated with the University of Chile, providing specialized medical care, education, and clinical research. The listing claims 240 GB of data.