Dark Web Informer - Cyber Threat Intelligence

A threat actor using the alias azazeljakel (posting under the tag "CORTEX") claims to have compromised Localizacion Empresarial Telcel (LET), a business location and fleet-tracking platform operated under the Mexican telecom brand Telcel (let.telcel.com).

A threat actor using the alias Zab26 is advertising for sale what they describe as a 533 GB "full-stack" healthcare dataset spanning French and European health systems.

A threat actor using the alias Soral claims to have breached H1 (h1.co), a global healthcare technology and data-analytics company.

A threat actor using the alias ChimeraZ claims to have breached Proprietes-Privees.com, a French real-estate network operating through independent property consultants.

A threat actor using the alias 2019 claims to be selling a patient database stolen from Ochre Health, an Australian medical-centre network providing general practice and allied health services.

A threat actor using the alias 2019 claims to have leaked the database of Zeemart, a Singapore-based B2B procurement and supply-chain platform for restaurants, cafes, and other food and beverage businesses.

A threat actor using the alias 2019 claims to have leaked the customer database of Napoleon Perdis, the Australian luxury cosmetics brand.

A threat actor using the alias ChimeraZ claims to be leaking a 4 million-listing real-estate dataset branded "Leboncoin Immobilier," aggregated from 13 French property portals including Leboncoin, SeLoger, and PAP.

A threat actor using the alias authentic claims to be selling a database of 35 million OkCupid users, saying it was scraped after gaining privileged access to the dating app's internal API.

A threat actor using the alias KLINZO007 claims to be selling the full user database of Tayara (tayara.tn), described as the largest online classifieds platform in Tunisia.

A threat actor using the alias an0bixz has publicly released what they claim is a full dataset stolen from BRPDV Ltda., a Brazilian company (brpdv.com.br), after an extortion deadline reportedly expired with no payment.

Live phishing & scam threat intelligence - a real-time mirror of the PhishDestroy blocklist. Scan any domain and browse 150k+ known-malicious sites across crypto, wallet, and brand-impersonation scams.

A federal judge has handed down a sentence of more than 26 years in prison to a California man who used one of the world's largest dark web marketplaces to ship methamphetamine and fentanyl across the country.

A threat actor using the alias macaroni claims to have exfiltrated the full customer CRM of Tradeify, an online trading platform, by abusing a Klaviyo private API key that was reportedly hardcoded in the site's client-side JavaScript.

A threat actor using the alias DNH ("DeathNoteHackersPH") claims to have leaked roughly 10 GB of internal data from Viva Communications, Inc. (Viva Entertainment), one of the largest entertainment conglomerates in the Philippines, via its site viva.com.ph.

A threat actor using the alias Kiria claims to have leaked an archive tied to Root-Me, the popular French cybersecurity training and CTF platform.

This daily article is intended to make it easier for those who want to stay updated with my regular Dark Web Informer and X/Twitter posts.

CVE-2026-20230 is an unauthenticated, remote server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME).

A threat actor using the alias l1ghtSoulHem, posting for "SoulHemTeam," claims to have breached the IEEA (State Institute for Adult Education) in Campeche, Mexico, and leaked a database tied to campeche.inea.gob.mx.

A threat actor using the alias DumpsecV2 ("Dumpsec") claims to be selling a large dataset stolen from Carvivo, a French SaaS provider whose "Carvivo Contact" platform manages automotive sales leads for car dealerships across Europe.