Loading story…
Group-IB reported that several Chinese-language dark web forums and Telegram channels are advertising massive troves of supposedly stolen corporate data that often do not represent genuine new breaches. The company identified recurring sellers and channels including Exchange Market, Chang’An Sleepless Night, Aiqianjin, Yiqun Data, and Phoenix Overseas Resources, saying they promote high-volume datasets from organizations worldwide using repetitive formats, aggressive messaging, and breach-related keywords to attract buyers and attention.
According to the research, many of the advertised records appear to be recycled or recombined from older public leaks such as Facebook 2021, Eatigo 2020, and Truecaller 2022, rather than fresh exfiltration. Group-IB said sample data showed multiple signs of fabrication or poor recombination, including mistranslated Arabic field values, mismatched names, phone numbers, and password hashes, as well as implausible database structures. The firm warned that these "lead data" brokers create noise that can misdirect incident response and urged defenders to verify whether claimed records match an organization’s real schema and whether identifiers within each record are internally consistent before treating a post as evidence of compromise.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Group-IB recommended that defenders verify whether advertised records match an organization's internal data structure and whether identifiers within each record are internally consistent before treating marketplace claims as legitimate breaches. The guidance was issued to reduce analytical noise caused by fabricated or recombined datasets.
The analysis found that sample datasets promoted by these brokers were often compiled from older public leaks such as Facebook 2021, Eatigo 2020, and Truecaller 2022. Group-IB also documented repeated inconsistencies including mistranslated Arabic field values, mismatched names and phone numbers, incompatible password hashes, and implausible database structures.
Group-IB analyzed Chinese-language dark web forums and Telegram channels advertising large volumes of purportedly stolen data and concluded that many claims were low-credibility 'lead data' rather than evidence of genuine breaches. The research highlighted recurring sources including Exchange Market, Chang’An Sleepless Night, Aiqianjin, Yiqun Data, and Phoenix Overseas Resources.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dark web monitoring reports described **unverified data leak claims** involving several organizations, including French parcel delivery firm **Colis Privé**. One post on **BreachForums** allegedly offered an upload of **22,564,381 records** attributed to Colis Privé, described as `.jsonl` files totaling **~4.1 GB**; no specific threat actor attribution or company confirmation was cited, and the notice characterized the situation as informational while scope is assessed. If authentic, the scale and format of the dataset would materially increase risk of **identity theft, credential stuffing, and targeted phishing** against customers. Separate dark web forum posts also alleged database exposures affecting **JobsGO** (Vietnam recruitment platform), **MyVete** (veterinary management platform), **PIXPAY** (Senegalese payment service), and **Groupe Fondasol** (France-based engineering). The claimed datasets reportedly include **CV/personal records**, and in some cases **API credentials and employee metadata**, with example figures including **~2.3 million records** for JobsGO and **~5.57 million records** for MyVete (verification not indicated). Across the claims, the primary business risk is downstream abuse of exposed personal and operational data for **social engineering, recruitment fraud, and account takeover**, rather than immediate exploitation of a specific software vulnerability.
Jun 29, 2026
A major data breach has exposed the entire user database of BreachForums, a prominent English-language hacking forum on the dark web. The breach was announced on the shinyhunte[.]rs platform, which published a message and made the leaked database available for download and analysis. BreachForums, which had previously replaced RaidForums after its seizure, has been a central hub for cybercriminal activity, including the distribution of stolen data and hacking tools. The forum has faced multiple shutdowns and seizures, but continued to operate under new management and through various hosting providers and domains. In addition to the BreachForums breach, recent activity on dark web forums has included the sale and sharing of data from a South Korean university and a Saudi Arabian employment platform. These incidents highlight the ongoing risks posed by data leaks and breaches on dark web marketplaces, where sensitive information is traded and discussed. Security researchers have made related indicators of compromise (IOCs) and analysis available to subscribers, emphasizing the need for vigilance among organizations whose data may be exposed in such forums.
Jun 29, 2026
A threat actor has claimed to have breached enterprise intelligence software provider **InfoDesk** and is offering the allegedly stolen data for sale on a dark web forum. Reporting indicates the sample data included five records from each of 18 organizations, along with InfoDesk records, and the actor claimed to hold as many as 1,000 records in total. The exposed information reportedly consists primarily of employee full names and corporate email addresses tied to major organizations, including firms in the pharmaceutical, healthcare, financial, consulting, and nonprofit sectors; Cybernews specifically said the data involved employees at companies such as **Moderna**, **Johnson & Johnson**, and **Bayer**. Researchers said the immediate danger is not large-scale identity theft but highly targeted phishing and social-engineering attacks. Because the records appear linked to a known enterprise vendor, attackers could use the contact details to craft convincing lures for credential theft, malware delivery, or follow-on business email compromise. The alleged incident adds to broader concerns over third-party supplier exposure, where compromises at service providers can create downstream risk for multiple corporate customers at once.
Jun 29, 2026