Dark Web Informer - Cyber Threat Intelligence

A threat actor using the alias 0xSec has posted what they describe as the database of Flawireless, a US-based wholesaler of mobile phone accessories and refurbished electronics that also trades as Techy Extra.

A threat actor using the alias NormalLeVrai has posted a “comeback” teaser headlined as a leak of GOV.CO, the official digital platform of the Colombian government, claiming 4,300,002 records.

A threat actor using the alias D3spair157 (operating as “Sociedad Privada 157”) has posted what they describe as a data leak from the Secretaría de Educación del Estado de Durango (SEED), Mexico's Durango state education department, reportedly obtained using administrator credentials to its student-management portal.

A threat actor using the alias Saturne has posted what they describe as the customer database of leroymerlin.es, the official Spanish e-commerce site of Leroy Merlin, a major home-improvement and DIY retail chain.

.dwi-root *, .dwi-root *::before, .dwi-root *::after { box-sizing: border-box; } .dwi-root { --bg: #0a0e16; --bg-2: #0d131f; --ink: #e8eef7; --ink-soft: #9fb0c7; --ink-dim: #5d6b82; --cyan: #34e0ff; --cyan-deep: #0bb6da; --amber: #ffb020; --red: #ff4d5e; --line: rgba(120, 160, 210, .14); --line-2: rgba(120, 160, 210, .26); --card:

A threat actor using the alias Albertcamus is advertising what they describe as a database of facial images and identity records for 347,178 Ecuadorian citizens.

Threat actors using the aliases M1sery157 and D3spair157 (operating as “Sociedad privada 157”) have posted what they describe as a database scraped from a Coahuila state government portal in Mexico.

CVE-2026-47729, nicknamed Squidbleed, is a heap buffer over-read in the FTP gateway of the Squid web proxy.

A threat actor using the alias shabat is advertising the sale of unauthorized access to France's SIV (Système d'Immatriculation des Véhicules), the country's official national vehicle-registration system.

A threat actor using the alias Saturne has posted what they describe as the database of FHF.fr, the official website of the Fédération Hospitalière de France (French Hospital Federation), which represents public healthcare and medico-social institutions and runs a major job board for the public health sector.

A threat actor using the alias Kazu is extorting Meducar (meducar.com), a Latin American telemedicine and patient-management platform owned by Grupo Cormos, an Argentine health-tech company.

A threat actor using the alias ChimeraZ has posted what they describe as the database of Whise.eu, a European real-estate CRM used by agencies and agents to manage leads, properties, and transactions.

A threat actor using the alias TomTom has posted what they describe as the member database of Stockaholics.net, a US-based online forum for stock-market, trading, cryptocurrency, and financial-market discussion.

A threat actor using the alias NightBroker has posted what they describe as the database of Deliware (deliware.app), an Indian food-delivery app serving restaurant owners, delivery drivers, and customers.

A threat actor using the alias xMetah has posted what they describe as a database from laregion.fr, the official site of France's Région Occitanie (Pyrénées-Méditerranée), one of the country's regional governments.

A forum user posting under the alias ctyzn, identifying as a concerned citizen, claims to have documented multiple recent government data exposures affecting Magelang City, Indonesia.

A threat actor using the alias Kazu is extorting ConsultorioMovil (consultoriomovil.net), a telemedicine and healthcare platform owned by Grupo Cormos (Cormos S.A.), an Argentine health-tech company.

A threat actor using the alias Kazu is extorting SaludTools (saludtools.com), a Colombian health-tech company that provides a cloud-based practice-management and electronic medical record (EMR/EHR) platform for physicians, clinics, and healthcare professionals.

Real-time uptime for Dark Web Informer's threat-intel feeds, APIs, and platform. Monitored continuously, refreshed every minute.

Live status, uptime, and verified .onion mirrors for active darknet markets. Real-time monitoring updated continuously by Dark Web Informer.