Malaysia's LHDN Tax Portal Data Offered for Sale, 10 Million Taxpayer Records Exposed
A threat actor using the alias dezetat is advertising a database from Malaysia's Inland Revenue Board (LHDN / IRBM), taken from the MyTax portal, for $20,000.
Dark Web Informer - Cyber Threat Intelligence
Libyan Ministry of Education Allegedly Breached, Students' IDs and Photos Threatened With Release
A threat actor using the alias EvaN47 claims to have breached the Libyan Ministry of Education (moe.gov.ly) and is threatening to publish a 287GB dataset of students' data if the ministry does not make contact.
Your Smart TV Might Be Working for Cybercriminals: Inside Google's Takedown of the NetNut Proxy Network
How a coordinated strike against a 2-million-device botnet exposes the hidden economy of residential proxies, and what it means for anyone with a connected device at home.
Broker miyako Advertising Root-Level Firewall Access to Five Organizations Across Four Countries
An initial access broker using the alias miyako is advertising root-level access to five separate organizations, each priced at $400 (non-negotiable).
Logistics Conglomerate Grupo ATC Data Offered for Sale After Ransom Refused
A threat actor using the alias Straightonumberone is selling what they describe as data stolen from Grupo ATC, a Mexican logistics conglomerate (comprising TLE, TLEA, and PHES), for $1,000 after a ransom negotiation reportedly failed.
Libyan Civil Aviation Authority Allegedly Breached, 300GB of Aviation Data Advertised
A threat actor using the alias EvaN47 has posted what they describe as a breach of the Libyan Civil Aviation Authority (caa.gov.ly), advertising a roughly 300GB dataset spanning 2015 to 2026 with a contact for acquisition.
Data From Domain Registrar and Host Netim Allegedly Offered for Sale, Including Source Code and Customer Records
A threat actor using the alias lucy is advertising a private, one-time sale of what they describe as comprehensive data from Netim.com, a French domain registrar and hosting provider, for $5,000 in cryptocurrency.
One POST to RCE: Unauthenticated Code Execution in Langflow (CVE-2026-33017)
CVE-2026-33017 is a critical unauthenticated remote code execution flaw in Langflow, the popular open-source visual framework for building AI agents and RAG pipelines.
French Tour Operator Pachatours Allegedly Breached, Passport, Payment and Credential Data Exposed
A threat actor using the alias misere, crediting collaborators (ChimeraZ and NightBroker), has posted what they describe as a complete database breach of Pachatours (pachatours.fr / pachatours.pro), a French tour operator specializing in Hajj packages and Tunisian beach holidays.
Municipal Police Records From the French Town of Le Pontet Allegedly Leaked
A threat actor using the alias ChimeraZ has posted what they title “the EPM of the Le Pontet city,” framing it as a database from a juvenile penitentiary for minors aged 13 to 17, and claiming 62,172 lines (about 8.4MB) in CSV format.
Qilin Ransomware Claims Musashino University in Japan, Posts Sample Documents
Qilin ransomware has listed Musashino University in Japan on its leak site and posted sample documents allegedly stolen from the institution. Unverified.
DragonForce Ransomware Leaks Data Allegedly Stolen from U.S. Healthcare Firm VIP Imaging
DragonForce ransomware has published 8.67 GB of data allegedly stolen from VIP Imaging, a U.S. cardiac imaging provider in Anaheim, California. Unverified.
Brazilian DETRAN SP Database of 13 Million Records Allegedly Leaked for Free
A threat actor using the alias pl4t0v has posted what they describe as a database from DETRAN SP, the motor-vehicle and identity authority of São Paulo state in Brazil, claiming 13 million lines (about 1.59GB) in SQLite format, and is sharing it for free.
Colombian Poultry Company Avícola El Madroño Allegedly Breached, 860MB of Data Leaked
A threat actor using the alias Saturne has posted what they describe as an 860MB data leak from Avícola El Madroño S.A. (avicolaelmadrono.com), a Colombian poultry and prepared-foods company based in Bucaramanga, and is sharing it for free.
PLAY Ransomware Allegedly Claims U.S. Firm J&J Gaming
A U.S. amusement, arcade & attractions company added to the PLAY ransomware data-leak site.
Canadian Clinic WELL Health Kensington Medical Centres Allegedly Breached, 307,000 Patient Records Held to Ransom
A threat actor using the alias Kazu is extorting WELL Health Kensington Medical Centres (kmc.cortico.ca), a community medical clinic in Canada that provides family medicine, same-day appointments, virtual care, and specialist referrals to patients of all ages, operating as part of WELL Health Technologies on the Cortico platform.
US Electronics Wholesaler Flawireless Allegedly Breached, Customer and Order Database Leaked
A threat actor using the alias 0xSec has posted what they describe as the database of Flawireless, a US-based wholesaler of mobile phone accessories and refurbished electronics that also trades as Techy Extra.
Alleged GOV.CO Colombia Leak Claims 4.3 Million Records, but the Posted Sample Is German Taxpayer Data
A threat actor using the alias NormalLeVrai has posted a “comeback” teaser headlined as a leak of GOV.CO, the official digital platform of the Colombian government, claiming 4,300,002 records.
Durango State Education Department Allegedly Breached, Exposing Records of Thousands of Primary School Children
A threat actor using the alias D3spair157 (operating as “Sociedad Privada 157”) has posted what they describe as a data leak from the Secretaría de Educación del Estado de Durango (SEED), Mexico's Durango state education department, reportedly obtained using administrator credentials to its student-management portal.
Leroy Merlin Spain Customer Database of Nearly 55,000 Records Allegedly Leaked
A threat actor using the alias Saturne has posted what they describe as the customer database of leroymerlin.es, the official Spanish e-commerce site of Leroy Merlin, a major home-improvement and DIY retail chain.
A real-time cyber threat intelligence platform that monitors the dark web and clearnet for data breaches, ransomware campaigns, darknet market activity, leaked databases, and active threat actors.