🚨🇪🇸 Dataset from unnamed Spanish InsurTech platform allegedly offered for sale, 2.15M+ records with IBAN data claimed
⠀
An unnamed major Spanish InsurTech platform is allegedly affected by a data exposure after a threat actor advertised what they describe as a complete internal customer dataset containing more than 2,153,505 records, including personal, business and banking information.
⠀
The actor claims the dataset includes approximately 1.79 million individual records tied to DNI/NIE identifiers, alongside more than 113,000 SL companies, 44,000 communities, 11,000 SA companies and other business entities.
⠀
The advertised data includes:
⠀
• First and last names
• DNI and NIE identifiers
• CIF identifiers
• Person and business entity types
• Dates of birth
• Physical addresses
• Postal codes
• Bank names
• Full IBANs
• Bank entity and branch codes
• Check digits
• Multiple mobile phone numbers
• Landline numbers
• International phone numbers
• Up to four email addresses per record
• Additional customer and financial profile data
⠀
The seller also claims the dataset contains international banking information, including approximately 3,100 IBANs from Andorra, 2,100 from Germany, and records associated with more than 20 additional countries.
⠀
The alleged dataset is being auctioned with a starting price of 8,000, a minimum bid increment of 500, and a buy-now price of 13,500.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
⠀
An unnamed major Spanish InsurTech platform is allegedly affected by a data exposure after a threat actor advertised what they describe as a complete internal customer dataset containing more than 2,153,505 records, including personal, business and banking information.
⠀
The actor claims the dataset includes approximately 1.79 million individual records tied to DNI/NIE identifiers, alongside more than 113,000 SL companies, 44,000 communities, 11,000 SA companies and other business entities.
⠀
The advertised data includes:
⠀
• First and last names
• DNI and NIE identifiers
• CIF identifiers
• Person and business entity types
• Dates of birth
• Physical addresses
• Postal codes
• Bank names
• Full IBANs
• Bank entity and branch codes
• Check digits
• Multiple mobile phone numbers
• Landline numbers
• International phone numbers
• Up to four email addresses per record
• Additional customer and financial profile data
⠀
The seller also claims the dataset contains international banking information, including approximately 3,100 IBANs from Andorra, 2,100 from Germany, and records associated with more than 20 additional countries.
⠀
The alleged dataset is being auctioned with a starting price of 8,000, a minimum bid increment of 500, and a buy-now price of 13,500.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇺🇸 D.C. man pleads guilty to distributing CSAM after FBI undercover investigation
Hershel Andrew Green III, 43, aka “FitddyG,” pleaded guilty to one federal count of distributing child sexual abuse material.
The FBI identified Green while investigating another person involved in distributing CSAM.
In July 2025, an undercover FBI agent exchanged messages with Green and received several videos containing child sexual abuse material.
Investigators identified him through digital records, open-source research, and surveillance at his residence in Washington, D.C.’s Columbia Heights neighborhood.
Green faces between 5 and 20 years in federal prison.
Sentencing is scheduled for November 30.
Source: https://www.justice.gov/usao-dc/pr/dc-man-pleads-guilty-distributing-child-pornography
Hershel Andrew Green III, 43, aka “FitddyG,” pleaded guilty to one federal count of distributing child sexual abuse material.
The FBI identified Green while investigating another person involved in distributing CSAM.
In July 2025, an undercover FBI agent exchanged messages with Green and received several videos containing child sexual abuse material.
Investigators identified him through digital records, open-source research, and surveillance at his residence in Washington, D.C.’s Columbia Heights neighborhood.
Green faces between 5 and 20 years in federal prison.
Sentencing is scheduled for November 30.
Source: https://www.justice.gov/usao-dc/pr/dc-man-pleads-guilty-distributing-child-pornography
❤1🔥1
🔪 Slice For Life - Part 2 🔪
Vexy Ransomware: /chat /server-status
You guys closed /server-status pretty quick. 😭
😭3
🔪 Slice For Life - Part 2 🔪
‼️ Fraud Shop: Findsome findsome[.]io [.]ru 192[.]142[.]1[.]95 ASN: 214036 🇳🇱 Org: Ultahost, Inc.
Everything is fair game by the way.
😈4🤔1
You suits are quick.
Company Tied to Breach of 153M Driver's Licenses Hit With Multiple Lawsuits
https://www.pcmag.com/news/company-tied-to-breach-of-153m-drivers-licenses-hit-with-multiple-lawsuits
Company Tied to Breach of 153M Driver's Licenses Hit With Multiple Lawsuits
https://www.pcmag.com/news/company-tied-to-breach-of-153m-drivers-licenses-hit-with-multiple-lawsuits
PCMAG
Company Tied to Breach of 153M Driver's Licenses Hit With Multiple Lawsuits
The driver's license data popped up on the dark web via a site called Nexus and was allegedly stolen from IDScan.net. Consumers who believe they were affected are now suing.
😁1
🚨🇫🇷 Préférence Formations dataset allegedly leaked on a cybercrime forum, 5.2K+ people claimed
⠀
Préférence Formations, a French platform focused on vocational and professional training, is allegedly affected by a data exposure after a threat actor published what they claim is an internal dataset containing information associated with 5,265 people.
⠀
The advertised dataset includes:
⠀
• Names
• Email addresses
• Cities and locations
• Country information
• Time zone information
• Additional training-related contact records
⠀
The actor claims the dataset contains 5,381 lines and is approximately 375 KB in CSV format.
⠀
A sample record was published directly in the forum post, along with download links for the alleged dataset.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
⠀
Préférence Formations, a French platform focused on vocational and professional training, is allegedly affected by a data exposure after a threat actor published what they claim is an internal dataset containing information associated with 5,265 people.
⠀
The advertised dataset includes:
⠀
• Names
• Email addresses
• Cities and locations
• Country information
• Time zone information
• Additional training-related contact records
⠀
The actor claims the dataset contains 5,381 lines and is approximately 375 KB in CSV format.
⠀
A sample record was published directly in the forum post, along with download links for the alleged dataset.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇫🇷 Clinique de Vontes dataset allegedly leaked on a cybercrime forum, 4.1K+ records claimed
⠀
Clinique de Vontes, a private mental health clinic located in Esvres-sur-Indre, Indre-et-Loire, France, is allegedly affected by a data exposure after a threat actor published what they claim is an internal dataset containing information associated with 4,111 people.
⠀
The advertised data includes:
⠀
• Names and identity-related fields
• Email addresses
• Mobile, landline and fax fields
• Language information
• Professional profiles and job functions
• Establishment and facility information
• Organizational group assignments
• Roles and responsibility information
• Service associations
• Workflow-related fields
• Administrative status information
• Additional internal account and personnel metadata
⠀
The actor claims the dataset contains 4,111 lines, is approximately 2.53 MB, and is provided in JSON format.
⠀
A sample record was published directly in the forum post, along with download links for the alleged dataset.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
⠀
Clinique de Vontes, a private mental health clinic located in Esvres-sur-Indre, Indre-et-Loire, France, is allegedly affected by a data exposure after a threat actor published what they claim is an internal dataset containing information associated with 4,111 people.
⠀
The advertised data includes:
⠀
• Names and identity-related fields
• Email addresses
• Mobile, landline and fax fields
• Language information
• Professional profiles and job functions
• Establishment and facility information
• Organizational group assignments
• Roles and responsibility information
• Service associations
• Workflow-related fields
• Administrative status information
• Additional internal account and personnel metadata
⠀
The actor claims the dataset contains 4,111 lines, is approximately 2.53 MB, and is provided in JSON format.
⠀
A sample record was published directly in the forum post, along with download links for the alleged dataset.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇧🇪 Collège Saint-Michel Moodle dataset allegedly leaked on a cybercrime forum, 1.8K+ people claimed
⠀
Collège Saint-Michel, a Belgian educational institution, is allegedly affected by a data exposure after a threat actor published what they claim is a dataset associated with its Moodle online learning platform.
⠀
The actor claims the dataset contains information associated with 1,836 people.
⠀
The advertised data includes:
⠀
• User identifiers
• First and last names
• Email addresses
• City and location information
• Country information
• Additional Moodle-related user records
⠀
The actor claims the dataset contains 1,838 lines, is approximately 105 KB, and is provided in CSV format.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
⠀
Collège Saint-Michel, a Belgian educational institution, is allegedly affected by a data exposure after a threat actor published what they claim is a dataset associated with its Moodle online learning platform.
⠀
The actor claims the dataset contains information associated with 1,836 people.
⠀
The advertised data includes:
⠀
• User identifiers
• First and last names
• Email addresses
• City and location information
• Country information
• Additional Moodle-related user records
⠀
The actor claims the dataset contains 1,838 lines, is approximately 105 KB, and is provided in CSV format.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨 Trezor says the ShipMonk data breach is larger than previously disclosed.
An additional ~67,000 U.S. customers were affected, exposing names, emails, phone numbers, shipping addresses, and order numbers from 2019–2021.
Trezor says ShipMonk had previously confirmed the data was deleted.
Affected customers have been emailed directly. Users are warned of increased phishing and physical security risks.
https://x.com/Trezor/status/2095807665603584085
An additional ~67,000 U.S. customers were affected, exposing names, emails, phone numbers, shipping addresses, and order numbers from 2019–2021.
Trezor says ShipMonk had previously confirmed the data was deleted.
Affected customers have been emailed directly. Users are warned of increased phishing and physical security risks.
https://x.com/Trezor/status/2095807665603584085
X (formerly Twitter)
Trezor (@Trezor) on X
Two days ago, we received an update from our shipping provider, ShipMonk. We're deeply saddened to share the news that the recent data breach affects more customers than originally thought.
Anoth…
Anoth…
🚨🇺🇸 HER dating platform dataset allegedly leaked on a cybercrime forum, 13.6K+ profiles and private messages claimed exposed
⠀
HER, a dating and community platform for queer women, nonbinary, trans and gender-nonconforming people, is allegedly affected by a data exposure after a threat actor published what they claim is data obtained from the platform.
⠀
The actor claims 13,622 user profiles were accessed through an IDOR vulnerability, alongside additional account, subscription, image and messaging data.
⠀
The advertised material includes:
⠀
• 13,622 user profiles
• 33,421 RevenueCat user records
• 165 premium account records
• 41,524 profile photos, claimed to total approximately 3.4 GB
• Additional user photos
• Private-message photos
• 128 private messages across 8 conversations
• Account and subscription-related information
⠀
The listing describes the main dataset as approximately 2.5 GB and claims tens of thousands of profile images were downloaded separately.
⠀
The actor published download links for the alleged material and specifically claims the profile information was obtained through an IDOR vulnerability.
⠀
The claims and the authenticity, source, scope and method of access to the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
⠀
HER, a dating and community platform for queer women, nonbinary, trans and gender-nonconforming people, is allegedly affected by a data exposure after a threat actor published what they claim is data obtained from the platform.
⠀
The actor claims 13,622 user profiles were accessed through an IDOR vulnerability, alongside additional account, subscription, image and messaging data.
⠀
The advertised material includes:
⠀
• 13,622 user profiles
• 33,421 RevenueCat user records
• 165 premium account records
• 41,524 profile photos, claimed to total approximately 3.4 GB
• Additional user photos
• Private-message photos
• 128 private messages across 8 conversations
• Account and subscription-related information
⠀
The listing describes the main dataset as approximately 2.5 GB and claims tens of thousands of profile images were downloaded separately.
⠀
The actor published download links for the alleged material and specifically claims the profile information was obtained through an IDOR vulnerability.
⠀
The claims and the authenticity, source, scope and method of access to the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇨🇷 Factoa administrative account access allegedly exposed on a cybercrime forum
Factoa, a Costa Rica-based electronic invoicing platform, is allegedly affected by a security compromise after a threat actor claimed to have obtained access to an administrative account within the application.
The actor claims the access allows management of:
• Customers
• Suppliers
• Invoices
• Orders
• Additional store administration functions
The allegedly accessible data includes:
• National ID / tax identification numbers
• Full names of individuals and businesses
• Phone numbers
• Email addresses
• Physical addresses and locations
• Business and commercial names
• Legal entity names
• Taxpayer identification types
• Customer account status information
• Tax exemption information and certificates
• Supplier and customer directory records
The actor also published a screenshot presented as proof of access to the Factoa administrative dashboard.
No public asking price is shown in the listing.
The claims and the authenticity, scope and current validity of the allegedly compromised access have not been independently verified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Factoa, a Costa Rica-based electronic invoicing platform, is allegedly affected by a security compromise after a threat actor claimed to have obtained access to an administrative account within the application.
The actor claims the access allows management of:
• Customers
• Suppliers
• Invoices
• Orders
• Additional store administration functions
The allegedly accessible data includes:
• National ID / tax identification numbers
• Full names of individuals and businesses
• Phone numbers
• Email addresses
• Physical addresses and locations
• Business and commercial names
• Legal entity names
• Taxpayer identification types
• Customer account status information
• Tax exemption information and certificates
• Supplier and customer directory records
The actor also published a screenshot presented as proof of access to the Factoa administrative dashboard.
No public asking price is shown in the listing.
The claims and the authenticity, scope and current validity of the allegedly compromised access have not been independently verified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇺🇸 Access to unnamed U.S. healthcare services company allegedly offered for sale on a cybercrime forum
An unnamed U.S. healthcare services company, with claimed annual revenue of approximately $85 million, is allegedly compromised after a threat actor advertised access to multiple parts of its cloud and development environment.
The advertised access allegedly includes:
• GitHub
• Google Cloud Platform (GCP)
• Microsoft Azure
• Salesforce OAuth2 access
• Twilio access
• Additional internal cloud and application resources
The affected company is not identified in the listing, and no additional information is provided regarding privilege level, number of accounts, persistence, or the specific systems accessible through the advertised credentials.
The claims and the authenticity, scope and current validity of the allegedly compromised access have not been independently verified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
An unnamed U.S. healthcare services company, with claimed annual revenue of approximately $85 million, is allegedly compromised after a threat actor advertised access to multiple parts of its cloud and development environment.
The advertised access allegedly includes:
• GitHub
• Google Cloud Platform (GCP)
• Microsoft Azure
• Salesforce OAuth2 access
• Twilio access
• Additional internal cloud and application resources
The affected company is not identified in the listing, and no additional information is provided regarding privilege level, number of accounts, persistence, or the specific systems accessible through the advertised credentials.
The claims and the authenticity, scope and current validity of the allegedly compromised access have not been independently verified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing