Loading story…
A hacking group has been impersonating law enforcement officers to trick major US tech companies into disclosing sensitive personal data. By sending spoofed emergency data requests, the attackers have successfully obtained names, addresses, phone numbers, and email addresses of targeted individuals from companies such as Charter Communications, Apple, Amazon, and Rumble. The process reportedly takes as little as 20 minutes, with the hackers providing doxing-as-a-service to paying customers seeking private information held by these firms.
The scheme relies on easily faked documents and spoofed email addresses, exploiting the trust tech companies place in urgent law enforcement requests. Law enforcement and company representatives have expressed concern over the ease with which these attacks are carried out, but declined to comment on specific incidents. The hackers show little regard for how the stolen information is used, raising significant privacy and security concerns for individuals whose data is exposed through these fraudulent requests.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
A hacker posing as Officer Jason Corse of the Jacksonville Sheriff's Office sent a fraudulent emergency data request to Charter Communications. A Charter privacy specialist responded within minutes and disclosed sensitive subscriber information including the target's name, address, phone numbers, and email.
Public reporting revealed that doxers had been posing as law enforcement to trick major tech firms into handing over private user data, highlighting weaknesses in emergency disclosure processes and email-based verification. The coverage also noted that the actors were profiting from the scheme and continuing to seek ways around improved defenses.
After incidents involving fraudulent emergency data requests, Amazon implemented additional safeguards to better verify law enforcement requests. The reporting indicates the broader problem persisted because many companies still accepted such requests through insecure email channels.
A hacking group led by an individual known as Exempt used compromised or spoofed law enforcement email accounts and forged emergency legal paperwork to impersonate police and request user data from major US tech companies. The activity affected companies including Apple, Amazon, Charter Communications, and Rumble, though the references do not specify when the campaign began.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A significant data breach at RemoteCOM, a provider of surveillance and monitoring software for the US criminal justice system, has resulted in the exposure of highly sensitive personal information belonging to nearly 14,000 individuals under court supervision. The breach, attributed to a hacker known as "wikkid," targeted RemoteCOM's proprietary SCOUT software, which is widely used by law enforcement agencies across 49 US states to monitor pretrial, probation, and parole clients. SCOUT operates as a comprehensive surveillance tool, recording keystrokes, capturing screenshots, tracking locations, and sending alerts based on specific keywords typed by monitored individuals. The leaked data was split into two main files: one containing detailed records of monitored clients, and another listing thousands of criminal justice employees who used RemoteCOM's services. The "clients" file included names, home addresses, phone numbers, email addresses, IP addresses, and specific charges or offenses, ranging from sex offenses and narcotics to terrorism, stalking, and hacking. The "officers" file exposed the names, work addresses, phone numbers, email addresses, unique IDs, and job titles of nearly 7,000 criminal justice professionals. The breach has raised concerns about the security of surveillance data, especially given the sensitive nature of the information and the potential risks to both monitored individuals and law enforcement personnel. Some records labeled clients as "tech savvy," and the data also revealed the financial burden placed on offenders, with installation and recurring monitoring fees for each device. The exposure of such detailed information could lead to threats, harassment, or violence against both clients and officers, particularly as some clients may not have been convicted but were merely under investigation or awaiting trial. The hacker described the breach as "one of the easiest" they had ever carried out, highlighting possible weaknesses in RemoteCOM's security posture. The incident has prompted calls for greater scrutiny of surveillance technology vendors and the protection of sensitive data managed by third-party providers. The leak also underscores the broader risks associated with the use of aggressive spyware-like tools in the criminal justice system. Law enforcement agencies and affected individuals now face heightened risks of doxxing, identity theft, and targeted attacks. The breach has sparked debate about the ethics and oversight of digital monitoring in the justice system, as well as the responsibilities of vendors handling such critical data. Security experts warn that the fallout from this breach could be long-lasting, with the potential for further exploitation of the leaked information by malicious actors. The incident serves as a stark reminder of the need for robust cybersecurity measures in organizations handling sensitive personal and law enforcement data.
Jun 29, 2026
The extortion group **ExfilSquad** claimed responsibility for breaching the U.K. Police National Legal Database (PNLD), a system managed by West Yorkshire Police, and publishing stolen data on the dark web. PNLD said the incident exposed names, organizations, and work email addresses of police officers, staff, criminal justice professionals, government partners, customers, and some users of the **Ask the Police** service. The group said it stole **1.9GB** of data covering roughly **135,000 records**, while PNLD said it had found no evidence that passwords or other security credentials were compromised and that the database does not hold confidential information on victims, witnesses, or offenders. Authorities said specialist cybersecurity organizations and the **UK National Crime Agency** were involved in the investigation and response. The breach has become a high-profile example of ExfilSquad’s broader hack-and-leak campaign, which targets exposed or misconfigured cloud and SaaS platforms including **Microsoft Dataverse**, **Power Pages**, case management systems, and CRM environments. Researchers said the group recently named **13 additional victims** across the United States, United Kingdom, and Sweden, and has shifted to **torrent-based distribution** of stolen data, using unique trackers and web seeds to make takedowns harder and accelerate spread through P2P networks. Reporting also linked active sharing nodes in **China** and **Russia** to the leaked PNLD data, underscoring the heightened risk of spear-phishing and social engineering against affected police and justice personnel.
Aug 15, 2026
The **Silent Ransom Group** — also tracked as **UNC3753**, **Luna Moth**, and **Chatty Spider** — has been targeting U.S. law firms and other professional, financial, insurance, and healthcare organizations with data-theft extortion campaigns that rely on social engineering instead of file encryption. FBI alerts and Google Mandiant reporting say the actors send invoice-themed phishing emails and follow up with voice calls impersonating internal IT or help desk staff, persuading employees to join screen-sharing sessions or install legitimate remote management tools such as AnyDesk, Zoho Assist, Bomgar, Splashtop, Syncro, Atera, and SuperOps. Once inside, the group rapidly searches document repositories and cloud stores for legal files, tax records, financial data, PII, and other sensitive material, then exfiltrates it with tools including WinSCP, hidden or renamed Rclone, Google Drive, Microsoft OneDrive, or victim-controlled file-sharing channels. Authorities said the campaign has escalated beyond remote access attempts to **in-person intrusions**, with imposters arriving at offices posing as technicians and connecting USB drives or external disks to steal data when remote social engineering fails. Mandiant said dozens of U.S. organizations were targeted between January and May, and in some cases the intrusion, theft, and extortion cycle was completed within a single business day, with ransom demands sent shortly after access ended. Researchers and the FBI linked the operation to the post-Conti cybercrime ecosystem and noted that its abuse of legitimate tools leaves few forensic artifacts, while Resecurity reported fast-flux infrastructure supporting leak sites including `business-data-leaks[.]com` and `ep6pheij[.]com`. The FBI and Google urged organizations to verify anyone claiming to be IT staff, restrict unauthorized remote management and VDI access, harden USB and removable-media controls, deploy phishing-resistant MFA, and closely monitor sensitive document systems.
Jun 29, 2026