Dark Web Informer - Cyber Threat Intelligence

A threat actor is advertising an alleged Mexican citizenship and passport document service, claiming to provide officially verified identity documents through in-person collection at government offices.

Perumda Tirta Musi Palembang has been named in a forum sale listing involving an alleged water utility customer database exposure.

A forum actor claims to have shared a Uruguay DNIC citizen database containing more than 5.8 million records.

A forum user claims to have shared a large business lead database focused on beauty salons, cosmetics businesses, and related personal care services across Canada and international regions.

A threat actor claims to have leaked a full database dump tied to Watiqa.ma, Morocco’s government electronic platform for requesting civil status documents.

A threat actor claims to be selling data tied to Nirvasa, an Indian digital healthcare platform focused on primary care, personalized treatment, and patient services.

This daily article is intended to make it easier for those who want to stay updated with my regular Dark Web Informer and X/Twitter posts.

A threat actor claims to be publishing additional databases tied to Indonesian Professional Certification Institutes (LSP), alleging that more than 20 LSP datasets have been obtained and are being released as part of an ongoing extortion-driven leak campaign.

A threat actor claims to have leaked a database tied to Dinas Penanaman Modal dan Pelayanan Terpadu Satu Pintu Kabupaten Belu (DPMPTSP), the Indonesian local government agency responsible for investment services and integrated business licensing in Belu Regency.

A threat actor claims to have leaked a complete database dump tied to Perm National Research Polytechnic University, a major technical university in Russia, from an internal accounting and monitoring system used for student research work.

A threat actor claims to be selling a fresh database dump linked to Stych, a French driving school and mobility training platform.

A threat actor claims to be selling a fresh database dump linked to Auchan, the French multinational retail group.

A threat actor claims to have breached Ícaro Cloud S.L., an Alicante-based managed service provider in Spain, allegedly exposing sensitive configuration data across 20 client networks.

This daily article is intended to make it easier for those who want to stay updated with my regular Dark Web Informer and X/Twitter posts.

Cisco has disclosed and patched CVE-2026-20182, a maximum-severity authentication bypass affecting Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager.

A threat actor is advertising a massive collection of allegedly leaked Burkina Faso identity documents, claiming the archive contains more than 50,000 scanned passports and national ID cards in original PDF quality.

A threat actor claims to have breached Xacria XNO (Xacria Network Orchestrator), a carrier-grade, cloud-native network orchestration platform used by Tier 1, 2, and 3 telecommunications operators in Italy for zero-touch provisioning and automation of fiber broadband, mobile, and enterprise network services.

A threat actor is selling a database from mutreasury, the centralized payment gateway connecting more than 28 Egyptian universities for tuition, application fees, and other student payments.

This daily article is intended to make it easier for those who want to stay updated with my regular Dark Web Informer and X/Twitter posts.

Federal prosecutors have charged Owe Martin Andresen, a 49-year-old German citizen believed to have served as the lead administrator of the once-massive darknet marketplace Dream Market, with laundering more than $2 million in proceeds tied to the site's commission accounts. German authorities arrested Andresen last week on parallel charges of their own.