Dark Web Informer - Cyber Threat Intelligence

A threat actor operating under the PayoutsKing brand (self-described as “Not RaaS”) has listed NTN Bearing Corporation of America on its extortion leak site, claiming to have exfiltrated 596 GB of data from the American manufacturer, a subsidiary of the global bearing maker NTN Corporation with revenue of $1.5B and approximately 4,700 employees.

A threat actor is reposting the previously reported SIVVI database for sale, listing approximately 300,000 UAE customer records from the Dubai-based fashion e-commerce platform founded in 2014 and now owned by noon.

A threat actor claims to have exfiltrated a database from the Ministry of Health of Vietnam containing over 480,000 sensitive records, including the personal data of doctors, nurses, and medical staff.

A threat actor is leaking the customer database of Akitatek, a French IT services and electronics repair company.

This daily article is intended to make it easier for those who want to stay updated with my regular Dark Web Informer and X/Twitter posts.

A threat actor claims to have breached FutureShop Egypt, an Egyptian grocery delivery platform, by exploiting an entirely exposed API that required no authentication.

.dwi-post, .dwi-post * { font-family: 'Inter', -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif; } .dwi-post { --dwi-card: rgba(127, 127, 127, 0.06); --dwi-border: rgba(127, 127, 127, 0.18); --dwi-muted: rgba(127, 127, 127, 0.85); --dwi-cyan: #38bdf8; --dwi-amber: #fbbf24; max-width: 680px; margin: 0 auto; font-size: 16px; line-height: 1.65; font-feature-settings:

This daily article is intended to make it easier for those who want to stay updated with my regular Dark Web Informer and X/Twitter posts.

A threat actor is selling the customer database of KAMS PARIS, a Parisian niche perfumery founded in 1960 and located at 6 Avenue de l’Opéra, specializing in rare niche perfumes, skincare, and beauty products with delivery across Europe.

A threat actor is selling a full archive described as one of the deepest technical leaks in the field of Surface Acoustic Wave (SAW) sensors and their application in smart diapers (Smart Diaper / Wetness Sensing).

Google's Threat Intelligence Group has documented what it describes as the first confirmed instance of threat actors leveraging artificial intelligence to engineer a zero-day exploit, marking a significant escalation in how AI is being weaponized for cyberattacks.

Mansoura University Allegedly Leaked Exposing 731 Contact Records From the Egyptian Academic Institution

German law enforcement has dismantled the relaunched version of the criminal online marketplace "Crimenetwork" and arrested its alleged operator on the Spanish island of Mallorca, the Federal Criminal Police Office (BKA) and the Frankfurt Public Prosecutor's Office's cybercrime unit (ZIT) announced on May 8, 2026.

Alan Bill, a 33-year-old Slovakian man from Bratislava, was sentenced Thursday to 200 months (16 years and 8 months) in federal prison by U.S. District Judge Cristian M. Stevens for his role in operating Kingdom Market, a darknet marketplace that ran from March 2021 to December 2023.

A threat actor claims to have leaked a database from Meetic, a major French online dating platform, releasing 7,169,561 records for free under the hashtag #freebreach3d.

A threat actor is selling a 243 million record dataset attributed to credilink.com.br, described in the post as a Brazilian credit information and risk analysis provider serving financial institutions and retailers.

A threat actor claims to have leaked a database from LDLC, a major French retailer of computers, components, smartphones, and gaming/audio/TV equipment, releasing 1,504,635 records for free under the hashtag #freebreach3d.

A threat actor is advertising what they describe as a US banking / premium credit client dataset tied to communitychoicecu.com, releasing a 1M+ record sample with full card numbers, names, issuing banks, and addresses.

Ivanti has issued an urgent security advisory for its Endpoint Manager Mobile (EPMM) product, disclosing five vulnerabilities including one that is actively exploited in the wild.

A threat actor claims to be selling a 2.47GB CSV database from real estate platform homes.at.world, totaling 7,023,773 lines split between 4,883,773 agent records and 2,140,000 investor records.