Dark Web Informer - Cyber Threat Intelligence

An actor using the handle "Erich" claims to have breached an unnamed conference-space company with approximately $80 million to $100 million in annual revenue.

An actor using the handle "0xRune" claims to have uploaded approximately 20 GB of Cast AI data.

An actor using the handle "Shenron" claims to have released a dataset associated with APICRYPT Messaging, a secure healthcare messaging system created in 1996 and managed by the APICEM association.

An actor using the handle "WolfBlxck" posted an updated recruitment announcement for Beelzebub ransomware, claiming the malware has been rewritten from scratch with a stronger emphasis on disabling endpoint defenses, suppressing telemetry and making incident response more difficult.

An actor using the handle "Liberland" is advertising a hosting service branded as Libre, offering what it describes as “bulletproof” or abuse-resistant VPS and VDS servers.

Records have been stolen from Southville Primary School in Bristol during a targeted cyberattack, according to Bristol City Council.

The Eclipse leak site lists Taiwan Otsuka Pharmaceutical and claims to hold approximately 832 GB of internal company data.

An actor using the handle "ByteToBreach" claims to have copied 10 databases from Ampath Laboratories out of an environment containing roughly 375 databases.

An actor using the handle "Alduin" claims to be selling a Climb Up customer dataset. The post describes Climb Up as the largest network of indoor climbing gyms in France and says the material concerns customers across 29 locations.

An actor using the handle "malconguerra2" claims to be sharing a KFC Venezuela dataset containing confidential information.

The German municipality of Tangerhütte was targeted in a cyberattack that its software provider believes was conducted with artificial intelligence.

Ivanti has released security updates for an actively exploited Connect Secure zero-day and six additional vulnerabilities affecting Neurons Patch for Intune and Xtraction.

An actor using the handle "Feel" claims to have leaked data associated with IAD France, a French real estate network supporting property buying, selling and rental activity.

An actor using the handle "DaOnlySpark" claims to be selling administrator access to Moveciti's database along with a database export dated October 9, 2026.

An actor using the handle "ChimeraZ" claims to be selling a dataset associated with Assurimo, a French insurance website offering multiple insurance products and services.

An actor using the handle "ChimeraZ" claims to have leaked a partial database associated with France's Ministry of Justice. The listing describes Justice.fr as the official French website providing information about the justice system and legal procedures.

An actor using the handle "TimeSape" is publicizing a breach claim involving France Pare-Brise, a French vehicle-glass repair and replacement company.

An actor using the handle "Syrv4x" claims to be selling a Swedish Fit dataset. Swedish Fit is described in the listing as a French fitness brand offering flexible, music-driven group workout classes through local gyms and online services.

Japanese authorities have transferred a Russian national suspected of being a key member of the Qilin ransomware operation to Germany.

A 24-year-old Spokane man has been arrested and charged with allegedly operating a dark web cocaine business that shipped thousands of parcels across the United States and internationally.