Dark Web Informer - Cyber Threat Intelligence

A seller posting as Resolute, claiming to have acted alongside a group using the Lapsus$ name, is advertising data from a complete compromise of Mercor, the US platform that recruits domain experts to produce training data for AI laboratories.

A forum user posting as cozypandas has published what they describe as the full customer database of IPRO, an eDiscovery platform used by law firms, corporations, and government agencies to manage data for litigation.

Broadcom has released emergency security updates for five vulnerabilities affecting VMware vCenter, ESX and ESXi, Workstation, Fusion, Cloud Foundation, vSphere Foundation, and several VMware Telco products.

A forum user posting as 0xSec has published what they describe as the database of Lire Demain, the schools and institutions network of the French children's publisher Auzou, which supplies books, kamishibai theatres, and educational materials to schools, early years settings, and local authorities.

A seller posting as weykofa is advertising what they describe as the database of Planity, the French online booking platform used by hair salons, beauty businesses, and spas to manage appointments and customer records.

A seller posting as 666op is advertising what they describe as a customer database from Shopee, the e-commerce marketplace operated by Sea Limited.

A forum user posting as ChimeraZ has published what they describe as the database of Allo.Solar, a French e-commerce platform selling photovoltaic and renewable energy equipment.

A forum user posting as 888 has published what they describe as a breach of Beny.com, operated by BENY New Energy, a manufacturer of solar photovoltaic safety equipment, microinverters, battery storage systems, and EV charging hardware.

A seller posting as LordVoldemort is advertising what they describe as a complete compromise of Podomoro University in Indonesia, an institution established in 2014 under the Agung Podomoro Education Foundation.

A seller posting as Demetrius is advertising what they describe as a corporate dataset from SMSA Express, one of Saudi Arabia's largest courier and logistics operators.

Threat actors posting as homercracker and cenfecracked claim to have extracted the full contents of CADPE, the executive procurement and administrative platform of the Michoacán State Government in Mexico, which handles public tenders and supplier registration.

A threat actor posting as anisanas2 claims to have extracted the full database of Distamed Morocco, a supplier of medical devices and healthcare solutions to hospitals, clinics, and practitioners, with a stated focus on cardiology, pulmonology, neurology, sleep diagnostics, rehabilitation, and medical imaging.

A forum user posting as 888 has published what they describe as the database of PokemonGym.nl, a Dutch online Pokémon RPG.

A threat actor posting as konata_izumi_shell claims to have breached a system belonging to Bolivia's Ministry of Health and Sports and extracted the complete database behind the Servicio Social de Salud Rural Obligatorio, the programme under which health sciences students and graduates carry out mandatory placements in rural and understaffed facilities.

A forum user posting as riche has published what they describe as a database from Bnine.com, the platform operated by B9, a US neobank offering checking accounts, debit cards, and early direct deposit.

A forum user posting as kitta has published what they describe as the database of Bebunk.com, a digital financial service offering current accounts and payment cards.

A forum user posting as kitta has published what they describe as the full database of RevolutionParts.com, the e-commerce platform used by automotive dealerships to sell parts online.

A threat actor posting as xpl0itrs is advertising the sale of data they claim to have taken from RapidFort, a US container hardening and software supply chain security vendor.

Dutch police have seized servers belonging to the pornographic content-sharing platform Motherless as part of an international investigation into suspected child sexual abuse material and videos allegedly depicting drug-facilitated sexual abuse.

CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway components of Palo Alto Networks PAN-OS software.