Loading story…
Compliance startup Delve has been accused of misleading customers about their privacy and security compliance status after an anonymous whistleblower, identifying as “DeepDelver,” alleged the company used fabricated evidence, pre-generated auditor conclusions, and weak control implementations to help clients appear compliant with frameworks and regulations including HIPAA and GDPR. The allegations also said Delve worked with audit firms Accorp and Gradient to rubber-stamp reports and enabled customers to publish misleading trust pages, potentially exposing those organizations to regulatory, legal, and contractual risk.
Delve has publicly denied the claims, saying the allegations are misleading and inaccurate and that it operates as an automation platform rather than a report issuer. The company said final compliance opinions are produced only by independent licensed auditors, that customers can choose their own auditors or use firms from Delve’s network, and that the disputed materials are standard documentation templates rather than fake evidence. The dispute widened with additional claims that confidential client reports were leaked and that security weaknesses may have exposed sensitive company data to outside parties, raising broader questions about the integrity of Delve’s audit relationships and compliance attestations.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
LiteLLM announced it is ending its relationship with Delve and will redo its security certifications with competitor Vanta and an independent third-party auditor. The public move by a Delve customer marked a concrete business fallout from the whistleblower allegations and loss of confidence in Delve's compliance work.
Following the whistleblower allegations, Delve disabled the 'book a demo' feature on its website, and Insight Partners appeared to remove a post about its $32 million investment in the company. The changes suggested public damage control and possible investor distancing amid the controversy.
Follow-on claims amplified the dispute by alleging that Delve leaked confidential client reports and that security weaknesses allowed external parties to access sensitive company data. These claims expanded the story beyond compliance practices to possible data exposure.
Delve responded publicly by calling the claims misleading and inaccurate, saying it is an automation platform rather than a report issuer and that final compliance opinions are produced only by independent licensed auditors. The company also said its templates are standard documentation aids, customers may choose their own auditors or use firms in Delve's network, and it is investigating any referenced leaks.
An anonymous Substack post by a person identifying as 'DeepDelver' alleged that Delve falsely represented customers as compliant with privacy and security regulations by fabricating evidence, pre-generating auditor conclusions, and relying on audit firms to rubber-stamp reports. The allegations said these practices could expose customers to HIPAA and GDPR liability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
techcrunch.com
Open sourcetechcrunch.com
Open sourcetechcrunch.com
Open sourcetechcrunch.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hargreaves Lansdown suffered customer-facing IT problems, including account-balance glitches and service outages, between September 2025 and May 2026, prompting customer concern that the investment platform had been hacked. The company said the incidents were technical issues and maintained there was no evidence of a cyber incident or data breach. In April 2026, the **Bashe** extortion group, also tracked as **APT73** and **Eraleign**, added Hargreaves Lansdown to its Tor leak site and claimed it had stolen a database of **658,259** unique users; a sample later appeared on DarkForums. Subsequent analysis found the records were likely recycled or fabricated, with selectively chosen UK entries and overlaps with older breaches including **Verifications.io** and **People Data Labs**, indicating the group used the firm's recent outages to make a false breach claim appear credible and increase reputational pressure.
Jul 12, 2026
A threat actor has claimed to have breached enterprise intelligence software provider **InfoDesk** and is offering the allegedly stolen data for sale on a dark web forum. Reporting indicates the sample data included five records from each of 18 organizations, along with InfoDesk records, and the actor claimed to hold as many as 1,000 records in total. The exposed information reportedly consists primarily of employee full names and corporate email addresses tied to major organizations, including firms in the pharmaceutical, healthcare, financial, consulting, and nonprofit sectors; Cybernews specifically said the data involved employees at companies such as **Moderna**, **Johnson & Johnson**, and **Bayer**. Researchers said the immediate danger is not large-scale identity theft but highly targeted phishing and social-engineering attacks. Because the records appear linked to a known enterprise vendor, attackers could use the contact details to craft convincing lures for credential theft, malware delivery, or follow-on business email compromise. The alleged incident adds to broader concerns over third-party supplier exposure, where compromises at service providers can create downstream risk for multiple corporate customers at once.
Jun 29, 2026
Vercel confirmed a security incident involving unauthorized access to certain internal systems after a threat actor using the name **ShinyHunters** claimed to be selling allegedly stolen company data on a hacking forum. The company said only a limited subset of customers was affected, its services remain operational, and it has engaged incident response experts, notified law enforcement, and is working directly with impacted customers. The actor claimed the stolen data included access keys, source code, database data, internal deployment access, and API keys, and shared a text file with 580 employee-related records along with a screenshot purportedly showing an internal Vercel Enterprise dashboard. Vercel advised customers to review environment variables and rotate secrets if necessary, while the authenticity of the leaked materials and the attribution to **ShinyHunters** remained unverified; the actor also claimed on Telegram that a **$2 million** ransom demand had been discussed with the company.
Aug 21, 2026