This report details a series of recent cyber incidents, providing key information for each event, including published URLs and associated screenshots, strictly based on the provided data.
1. Alleged data breach of Colegio De Abogados
- Category: Data Breach
- Content: Threat actor claims to have leaked data from Colegio De Abogados, Argentina. The compromised data reportedly contains 3077 records of registered attorneys and 354 records of applications for civil registry certificates.
- Date: 2025-10-26T22:29:13Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-COLABRO-ORG-AR-DATABASE-LEAK-DOWNLOAD)
- Screenshots:
- Threat Actors: Z1k3n
- Victim Country: Argentina
- Victim Industry: Legal Services
- Victim Organization: colegio de abogados
- Victim Site: colabro.org.ar
2. Alleged sale of access to CNC Stone
- Category: Initial Access
- Content: Threat actor claims to have leaked admin access credentials to CNC Stone, Vietnam.
- Date: 2025-10-26T22:20:30Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Vietnamese-website-ncstone-vn-Admin-access)
- Screenshots:
- Threat Actors: crazyboy68
- Victim Country: Vietnam
- Victim Industry: Import & Export
- Victim Organization: cnc stone
- Victim Site: cncstone.vn
3. Alleged data breach of Transdev Canada
- Category: Data Breach
- Content: Group claims to have breached the organization’s data.
- Date: 2025-10-26T22:14:56Z
- Network: tor
- Published URL: (http://fjg4zi4opkxkvdz7mvwp7h6goe4tcby3hhkrz43pht4j3vakhy75znyd.onion/companies/limocar)
- Screenshots:
- Threat Actors: CoinbaseCartel
- Victim Country: Canada
- Victim Industry: Transportation & Logistics
- Victim Organization: transdev canada
- Victim Site: transdev.ca
4. Alleged data sale of Il Passaggio by Capanna
- Category: Data Breach
- Content: Threat actor claims to be selling leaked data from Il Passaggio by Capanna, a restaurant based in Italy. The compromised data reportedly includes name, surname and email.
- Date: 2025-10-26T22:09:04Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Italian-Website-ilpassaggiobycapanna-com-DataBase)
- Screenshots:
- Threat Actors: crazyboy68
- Victim Country: Italy
- Victim Industry: Restaurants
- Victim Organization: il passaggio by capanna
- Victim Site: ilpassaggiobycapanna.com
5. Alleged Sale of VPN + Local Admin Access to Industrial Equipment in Portugal
- Category: Initial Access
- Content: Threat actor claims to be selling VPN access along with local administrator (DU) rights to industrial equipment systems in Portugal.
- Date: 2025-10-26T20:19:17Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/269003/)
- Screenshots:
- Threat Actors: personX
- Victim Country: Portugal
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
6. Metal Pros, LLC falls victim to PLAY Ransomware
- Category: Ransomware
- Content: Group claims to have obtained the organization’s data and intends to publish them within 3 days.
- Date: 2025-10-26T19:29:10Z
- Network: tor
- Published URL: (http://j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion/topic.php?id=I1WCFDUZcW71f)
- Screenshots:
- Threat Actors: PLAY
- Victim Country: USA
- Victim Industry: Building and construction
- Victim Organization: metal pros, llc
- Victim Site: metalprosllc.com
7. LaBonne’s Markets falls victim to PLAY Ransomware
- Category: Ransomware
- Content: Goup claims to have obtained the organization’s data and intends to publish them within 3 days.
- Date: 2025-10-26T19:25:54Z
- Network: tor
- Published URL: (http://j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion/topic.php?id=AvkLqYqjo5pqqS)
- Screenshots:
- Threat Actors: PLAY
- Victim Country: USA
- Victim Industry: Retail Industry
- Victim Organization: labonne’s markets
- Victim Site: labonnes.com
8. Alleged unauthorized access to a public transportation management system in Ukraine
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to a public transport management system in Ukraine.
- Date: 2025-10-26T18:23:40Z
- Network: telegram
- Published URL: (https://t.me/n2LP_wVf79c2YzM0/2101)
- Screenshots:
- Threat Actors: Infrastructure Destruction Squad
- Victim Country: Ukraine
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
9. Alleged sale of customer data from Consumer Services industry in USA
- Category: Data Breach
- Content: The threat actor claims to be selling customer data from Consumer Services industry in USA. The compromised dataset contains 4.5 millions records that includes name and email.
- Date: 2025-10-26T18:14:39Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/269001/)
- Screenshots:
- Threat Actors: betway
- Victim Country: USA
- Victim Industry: Consumer Services
- Victim Organization: Unknown
- Victim Site: Unknown
10. Alleged data sale of Department of Agricultural Extension in Thailand
- Category: Data Breach
- Content: The threat actor claims to be selling data from Department of Agricultural Extension in Thailand. The compromised dataset contains 5 millions records that includes id card, fullname, nationality, mobile, email, etc.
- Date: 2025-10-26T17:59:28Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268999/)
- Screenshots:
- Threat Actors: Kazu
- Victim Country: Thailand
- Victim Industry: Government Administration
- Victim Organization: thailand’s department of agricultural extension (doae)
- Victim Site: doae.go.th
11. Alleged leak of unauthorized access to the public transport management system in Ukraine.
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to the public transport management system in Ukraine.
- Date: 2025-10-26T17:52:57Z
- Network: telegram
- Published URL: (https://t.me/n2LP_wVf79c2YzM0/2101)
- Screenshots:
- Threat Actors: Infrastructure Destruction Squad
- Victim Country: Ukraine
- Victim Industry: Translation & Localization
- Victim Organization: public transport management system in ukrain
- Victim Site: Unknown
12. Alleged sale of admin access to an unidentified Home Appliance Store in Spain
- Category: Initial Access
- Content: The threat actor claims to be selling admin access to an unidentified Home Appliance Store in Spain, including the shell, and adminer access. Threat actor also selling 243 credit card records processed via Redsys from last month.
- Date: 2025-10-26T17:39:53Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268997/)
- Screenshots:
- Threat Actors: kobenotnow
- Victim Country: Spain
- Victim Industry: E-commerce & Online Stores
- Victim Organization: Unknown
- Victim Site: Unknown
13. Alleged leak of sensitive documents related to the United Kingdom Ministry of Defence
- Category: Data Breach
- Content: Threat actor claims to have leaked sensitive documents from Ministry of Defence, United Kingdom. The leaked data reportedly includes staff and senior official data.Note: The authenticity of the leak has not been verified yet.
- Date: 2025-10-26T17:33:27Z
- Network: telegram
- Published URL: (https://t.me/CyberSquad313/7)
- Screenshots:
- Threat Actors: Cyber Squad 313
- Victim Country: UK
- Victim Industry: Government Administration
- Victim Organization: ministry of defence
- Victim Site: gov.uk/mod
14. InfraCom Group AB falls victim to Qilin Ransomware
- Category: Ransomware
- Content: Group claims to have obtained the organization’s data.
- Date: 2025-10-26T17:16:07Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=b91da6cf-4c42-3299-a32e-623955b62fe7)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: Sweden
- Victim Industry: Information Technology (IT) Services
- Victim Organization: infracom group ab
- Victim Site: infracomgroup.se
15. Alleged Sale of 100K Corporate MailPass Combo List
- Category: Combo List
- Content: The threat actor claims to be selling a database containing 100,000 corporate email and password combinations.
- Date: 2025-10-26T16:37:01Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/268995/)
- Screenshots:
- Threat Actors: Domainstore
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
16. Trojan 1337 targets the website of ASM Abdur Rab Government College
- Category: Defacement
- Content: The group claims to have defaced the website of ASM Abdur Rab Government College.
- Date: 2025-10-26T16:17:03Z
- Network: telegram
- Published URL: (https://t.me/c/2805167925/77)
- Screenshots:
- Threat Actors: Trojan 1337
- Victim Country: Bangladesh
- Victim Industry: Higher Education/Acadamia
- Victim Organization: asm abdur rab government college
- Victim Site: asmrobcollege.edu.bd
17. Trojan 1337 targets the website of Bangladesh Government Bathshiri High School
- Category: Defacement
- Content: The group claims to have defaced the website of Bangladesh Government Bathshiri High School.
- Date: 2025-10-26T16:02:35Z
- Network: telegram
- Published URL: (https://t.me/c/2805167925/73)
- Screenshots:
- Threat Actors: Trojan 1337
- Victim Country: Bangladesh
- Victim Industry: Education
- Victim Organization: bangladesh government bathshiri high school
- Victim Site: batshirihs.edu.bd
18. Trojan 1337 targets the website of Atatürk Bangladesh Government Model High School
- Category: Defacement
- Content: The group claims to have defaced the website of Atatürk Bangladesh Government Model High School
- Date: 2025-10-26T15:41:25Z
- Network: telegram
- Published URL: (https://t.me/c/2805167925/71)
- Screenshots:
- Threat Actors: Trojan 1337
- Victim Country: Bangladesh
- Victim Industry: Education
- Victim Organization: atatürk bangladesh government model high school
- Victim Site: ataturkschool.edu.bd
19. Trojan 1337 targets the website of Government of Bangladesh, Ministry of Power, Energy and Mineral Resources (MPEMR)
- Category: Defacement
- Content: The group claims to have defaced the website of Government of Bangladesh, Ministry of Power, Energy and Mineral Resources (MPEMR).
- Date: 2025-10-26T15:27:31Z
- Network: telegram
- Published URL: (https://t.me/c/2805167925/69)
- Screenshots:
- Threat Actors: Trojan 1337
- Victim Country: Bangladesh
- Victim Industry: Energy & Utilities
- Victim Organization: government of bangladesh, ministry of power, energy and mineral resources (mpemr).
- Victim Site: mpemr.gov.bd
20. Alleged sale of Romanian ID cards
- Category: Data Breach
- Content: Threat actor claims to be selling leaked Romanian ID cards.
- Date: 2025-10-26T14:48:17Z
- Network: tor
- Published URL: (http://qeei4m7a2tve6ityewnezvcnf647onsqbmdbmlcw4y5pr6uwwfwa35yd.onion/Thread-Selling-ID-Cards-Full-Data-idlabz-mysellauth-com)
- Screenshots:
- Threat Actors: fuckoverflow
- Victim Country: Romania
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
21. Alleged data sale of the Ministry of Health of the Government of Chiapas
- Category: Data Breach
- Content: The threat actor claims to be selling 62.5 GB of data from the Ministry of Health of the Government of Chiapas. The compromised dataset contains 70,145 records.
- Date: 2025-10-26T14:27:34Z
- Network: tor
- Published URL: (http://qeei4m7a2tve6ityewnezvcnf647onsqbmdbmlcw4y5pr6uwwfwa35yd.onion/Thread-Selling-Official-website-of-the-Chiapas-State-Health-Secretariat-Breach-70k)
- Screenshots:
- Threat Actors: Kazu
- Victim Country: Mexico
- Victim Industry: Government Administration
- Victim Organization: ministry of health of the government of chiapas
- Victim Site: saludchiapas.gob.mx
22. Dublin Airport falls victim to Everest Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 1,533,900 user records from the organization and intends to publish the data within 6–7 days.
- Date: 2025-10-26T14:24:20Z
- Network: tor
- Published URL: (http://ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion/news/dublinairport/)
- Screenshots:
- Threat Actors: Everest
- Victim Country: Ireland
- Victim Industry: Airlines & Aviation
- Victim Organization: dublin airport
- Victim Site: dublinairport.com
23. GARUDA ERROR SYSTEM targets multiple Indian websites
- Category: Defacement
- Content: The group claims to have defaced multiple Indian websites.
- Date: 2025-10-26T13:58:18Z
- Network: telegram
- Published URL: (https://t.me/c/2004556114/2122)
- Screenshots:
- Threat Actors: GARUDA ERROR SYSTEM
- Victim Country: India
- Victim Industry: Manufacturing
- Victim Organization: amerys special refractory
- Victim Site: acaciakilnfurniture.net
24. Alleged leak of login access of Suphan Buri Provincial Education Office
- Category: Initial Access
- Content: The group claims to have leaked password to Suphan Buri Provincial Education Office
- Date: 2025-10-26T13:57:07Z
- Network: telegram
- Published URL: (https://t.me/nxbbsec/2941)
- Screenshots:
- Threat Actors: NXBB.SEC
- Victim Country: Thailand
- Victim Industry: Government Administration
- Victim Organization: suphan buri provincial education office
- Victim Site: spbpeo.moe.go.th
25. Alleged data breach of Christian Leaders Institute
- Category: Data Breach
- Content: Threat actor claims to have leaked data from Christian Leaders Institute. The compromised database reportedly contains over 1,000,000 user records, including first and last names, email addresses, phone numbers, physical addresses, hashed passwords, last login details with IP addresses, and user profile information.File format: CSV
- Date: 2025-10-26T13:56:48Z
- Network: telegram
- Published URL: (https://t.me/itrussia_ib/210)
- Screenshots:
- Threat Actors: IT RUSSIA
- Victim Country: USA
- Victim Industry: E-Learning
- Victim Organization: christian leaders institute
- Victim Site: christianleadersinstitute.org
26. South Alabama Regional Planning Commission falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data.
- Date: 2025-10-26T13:49:53Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=3ebaf509-eb22-3ea5-8813-16a215910c85)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: USA
- Victim Industry: Non-profit & Social Organizations
- Victim Organization: south alabama regional planning commission
- Victim Site: sarpc.org
27. Alleged leak of login access of National Research Council of Thailand
- Category: Initial Access
- Content: The group claims to have leaked access to National Research Council of Thailand.
- Date: 2025-10-26T13:46:50Z
- Network: telegram
- Published URL: (https://t.me/nxbbsec/2938)
- Screenshots:
- Threat Actors: NXBB.SEC
- Victim Country: Thailand
- Victim Industry: Government Administration
- Victim Organization: national research council of thailand
- Victim Site: dric.nrct.go.th
28. Alleged Data Leak of Indian ITI Principals’ Database
- Category: Data Breach
- Content: A threat actor claims to have leaked a database of principals from multiple Indian Industrial Training Institutes. The dataset reportedly includes sensitive personal information such as names, contact numbers, email addresses, and ITI addresses.
- Date: 2025-10-26T12:47:49Z
- Network: telegram
- Published URL: (https://t.me/CyberSquad313/5)
- Screenshots:
- Threat Actors: Cyber Squad 313
- Victim Country: India
- Victim Industry: Education
- Victim Organization: Unknown
- Victim Site: Unknown
29. Alleged unauthorized access to unidentified Automation of water fire extinguishing in Ukraine
- Category: Initial Access
- Content: The group claims to have gained access to the unidentified system monitors and controls the building’s water fire extinguishing system in Ukraine. They reportedly have the ability to control the firebox doors, water switch inside the fireboxes, water supply valve to the system, electrical supply status and display the power status.
- Date: 2025-10-26T12:13:18Z
- Network: telegram
- Published URL: (https://t.me/c/2878397916/50)
- Screenshots:
- Threat Actors: Hider_Nex
- Victim Country: Ukraine
- Victim Industry: Industrial Automation
- Victim Organization: Unknown
- Victim Site: Unknown
30. AUGE falls victim to INC RANSOM Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data.
- Date: 2025-10-26T12:08:38Z
- Network: tor
- Published URL: (http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures/68fe080ce1a4e4b3ff538e00)
- Screenshots:
- Threat Actors: INC RANSOM
- Victim Country: USA
- Victim Industry: Oil & Gas
- Victim Organization: auge
- Victim Site: auge.com
31. Alleged leak of unidentifeid UK Fullz data
- Category: Data Breach
- Content: The threat actor claims to have leaked unidentified UK Fullz data.
- Date: 2025-10-26T11:28:53Z
- Network: openweb
- Published URL: (https://xss.pro/threads/143947/)
- Screenshots:
- Threat Actors: p0tsu
- Victim Country: UK
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
32. Alleged data leak of the Secretariat of Public Education in Mexico
- Category: Data Breach
- Content: The threat actor claims to have leaked data from the Secretariat of Public Education in Mexico, allegedly containing personal data, contact information, academic records, and addresses.Note: The authenticity of the claim has yet to be verified. This organization was recently breached by “Alz_157s” on October 7, 2025.
- Date: 2025-10-26T11:18:57Z
- Network: tor
- Published URL: (http://qeei4m7a2tve6ityewnezvcnf647onsqbmdbmlcw4y5pr6uwwfwa35yd.onion/Thread-DATABASE-DATA-LEAK-OF-STUDENTS-OF-CAMPECHE)
- Screenshots:
- Threat Actors: vkss
- Victim Country: Mexico
- Victim Industry: Government Administration
- Victim Organization: secretariat of public education
- Victim Site: sep.gob.mx
33. Alleged leak of login access of Iklim Travel
- Category: Initial Access
- Content: The group claims to have leaked access to Iklim Travel
- Date: 2025-10-26T11:15:17Z
- Network: telegram
- Published URL: (https://t.me/hezi_rash/190)
- Screenshots:
- Threat Actors: HEZI RASH
- Victim Country: Turkey
- Victim Industry: Leisure & Travel
- Victim Organization: iklim travel
- Victim Site: iklimtravel.com
34. REX MD falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data.
- Date: 2025-10-26T10:47:10Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=6b687487-a155-30e3-b327-a03903307870)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: USA
- Victim Industry: Hospital & Health Care
- Victim Organization: rex md
- Victim Site: rexmd.com
35. GHOST’S OF GAZA targets the website of Shimulbari Kadambari Moddhakandi Hazrabari High School
- Category: Defacement
- Content: The group claims to have defaced the website of Shimulbari Kadambari Moddhakandi Hazrabari High School .
- Date: 2025-10-26T10:22:58Z
- Network: telegram
- Published URL: (https://t.me/GHOSTS_OF_GAZA/79)
- Screenshots:
- Threat Actors: GHOST’S OF GAZA
- Victim Country: Bangladesh
- Victim Industry: Education
- Victim Organization: shimulbari kadambari moddhakandi hazrabari high school
- Victim Site: skmh.edu.bd
36. Alleged data breach of CNC Magazine Kazakhstan
- Category: Data Breach
- Content: The threat actor claims to have leaked data from CNC Magazine Kazakhstan, allegedly containing phone numbers, email addresses, and physical addresses.
- Date: 2025-10-26T10:00:04Z
- Network: tor
- Published URL: (http://qeei4m7a2tve6ityewnezvcnf647onsqbmdbmlcw4y5pr6uwwfwa35yd.onion/Thread-DATABASE-FREE-Kazakhstan-DATABASE-cncmagazine-kz)
- Screenshots:
- Threat Actors: trashfunny
- Victim Country: Kazakhstan
- Victim Industry: Online Publishing
- Victim Organization: cnc magazine kazakhstan
- Victim Site: cncmagazine.kz
37. HEZI RASH targets the website of Iklim Travel
- Category: Defacement
- Content: The group claims to have deface the website of Iklim TravelMirror : https://archive.ph/aijS2
- Date: 2025-10-26T09:12:37Z
- Network: telegram
- Published URL: (https://t.me/hezi_rash/185)
- Screenshots:
- Threat Actors: HEZI RASH
- Victim Country: Turkey
- Victim Industry: Leisure & Travel
- Victim Organization: iklim travel
- Victim Site: iklimtravel.com
38. Alleged leak of RCE vulnerability on the website of Dot Internet
- Category: Vulnerability
- Content: Threat actor claims to have discovered a possible Remote Code Execution (RCE) issue on Dot Internet Ltd.’s site (dotinternetbd.com), apparently sending commands via a web parameter and observing command output in the server response. They report using intercepted HTTP requests to probe the endpoint and saw signs consistent with command execution (e.g., shell command output), though they did not report extracting bulk data.
- Date: 2025-10-26T06:10:26Z
- Network: telegram
- Published URL: (https://t.me/Agent2p/39)
- Screenshots:
- Threat Actors: Agent 2p
- Victim Country: Bangladesh
- Victim Industry: Network & Telecommunications
- Victim Organization: dot internet
- Victim Site: dotinternetbd.com
39. Alleged data breach of AirsoftCanada
- Category: Data Breach
- Content: The threat actor claims to have leaked the AirsoftCanada.net forum database, containing 413,000 user records. The compromised data reportedly includes email addresses, IP addresses, usernames, and hashed passwords.NB: The organization was previously breached on 05/02/2022.
- Date: 2025-10-26T06:01:01Z
- Network: openweb
- Published URL: (https://breached.sh/Thread-Airsoftcanada-413k-2025)
- Screenshots:
- Threat Actors: Seacoat
- Victim Country: Canada
- Victim Industry: Sporting Goods
- Victim Organization: airsoftcanada
- Victim Site: airsoftcanada.com
40. Latona Trucking Inc falls victim to DragonForce Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 72.91 GB of the organization’s data.
- Date: 2025-10-26T05:59:25Z
- Network: tor
- Published URL: (http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog)
- Screenshots:
- Threat Actors: DragonForce
- Victim Country: USA
- Victim Industry: Building and construction
- Victim Organization: latona trucking inc
- Victim Site: latonatrucking.com
41. Saturn Machine Inc falls victim to DragonForce Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 102.37 GB of organization’s data.
- Date: 2025-10-26T05:58:10Z
- Network: tor
- Published URL: (http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog)
- Screenshots:
- Threat Actors: DragonForce
- Victim Country: USA
- Victim Industry: Manufacturing
- Victim Organization: saturn machine inc
- Victim Site: saturnmachine.com
42. West, Welch, Reed Engineers, Inc. falls victim to DragonForce Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 104.69 GB of organization’s data.
- Date: 2025-10-26T05:48:35Z
- Network: tor
- Published URL: (http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog)
- Screenshots:
- Threat Actors: DragonForce
- Victim Country: USA
- Victim Industry: Machinery Manufacturing
- Victim Organization: west, welch, reed engineers, inc.
- Victim Site: wwrengrs.com
43. Alleged Sale of Crypto Casino data from multiple countries
- Category: Data Breach
- Content: Threat actor claims to be selling a 1.7 GB uncompressed CSV database of crypto & online-casino leads targeting Asian markets (mostly Philippines, Thailand) and the USA.
- Date: 2025-10-26T05:46:44Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/crypto-casino-data.44879/)
- Screenshots:
- Threat Actors: jacksparrow874
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
44. Alleged data breach of Hello-Online
- Category: Data Breach
- Content: The threat actor claims to have leaked the Hello-Online.org forum database, containing 189,000 user records. The exposed information reportedly includes email addresses, IP addresses, usernames, and salted MD5 password hashes.
- Date: 2025-10-26T05:40:52Z
- Network: openweb
- Published URL: (https://breached.sh/Thread-hello-online-org-189k-JP)
- Screenshots:
- Threat Actors: Seacoat
- Victim Country: Japan
- Victim Industry: Social Media & Online Social Networking
- Victim Organization: hello-online
- Victim Site: hello-online.org
45. Alleged data breach of Breach Forums
- Category: Data Breach
- Content: The threat actor claims to have leaked 1 TB archive of data from BreachForums.
- Date: 2025-10-26T05:07:11Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/breachforums-archive-1-tb-of-data.44825/)
- Screenshots:
- Threat Actors: Nousername_147
- Victim Country: USA
- Victim Industry: Social Media & Online Social Networking
- Victim Organization: breach forums
- Victim Site: Unknown
46. Alleged data breach of Instituto del Niño y Adolescente del Uruguay (INAU)
- Category: Data Breach
- Content: The threat actor claims to have leaked a database of INAU (Instituto del Niño y Adolescente del Uruguay) employees, containing details of around 1.1k workers. The data, shared in an Excel (.xlsx) file, allegedly includes each employee’s role, document number, full name, and department
- Date: 2025-10-26T04:27:08Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-inau-Uruguay-1-1k)
- Screenshots:
- Threat Actors: minter
- Victim Country: Uruguay
- Victim Industry: Government & Public Sector
- Victim Organization: instituto del niño y adolescente del uruguay (inau)
- Victim Site: inau.edu.uy
47. Alleged sale of unauthorized access to an ISP in USA
- Category: Initial Access
- Content: Threat actor claims to be selling unauthorized access to an unidentified Internet Service Provider in USA.
- Date: 2025-10-26T04:14:53Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Access-US-ISP-Providers)
- Screenshots:
- Threat Actors: user40603
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
48. Alleged data sale of Coinbase & Binance Logs
- Category: Data Breach
- Content: A threat actor claims to be selling 441,000 stealer logs containing sensitive user data allegedly sourced from Binance, Blockchain.com, and Coinbase
- Date: 2025-10-26T03:55:01Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/441k-logs-binance-coinbase-etc.44880/)
- Screenshots:
- Threat Actors: jacksparrow874
- Victim Country: Unknown
- Victim Industry: Financial Services
- Victim Organization: Unknown
- Victim Site: Unknown
49. Alleged sale of CyberVault malware
- Category: Malware
- Content: Threat actor claims to be selling CyberVault, a black-market service for spammers and black-hat operators offering 0-day exploits, an “autoshop” bot, SMTP access (AWS SES, SendGrid, Mailgun, Brevo, etc.), and a global leads/mailist database covering 190+ countries. The listing advertises specialized tools (exploit scripts, SMTP builders, mailist checkers for services like Netflix/Spotify/Amazon)
- Date: 2025-10-26T03:43:45Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-%F0%9F%94%93-CyberVault-Best-autoshop-bot-Exploits-0day-SMTP-TOOLS-World-Leads-Database)
- Screenshots:
- Threat Actors: firedown404
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
50. Alleged sale of unauthorized admin access to an unidentified e-commerce shop in Saudi Arabia
- Category: Initial Access
- Content: The threat actor claims to be selling admin access to a Magento-based e-commerce platform in Saudi Arabia. The access reportedly includes control over dashboard, customers, orders, sales, and marketing modules. According to the post, the breached system contains around 157,780 customer records and 196,282 order records.
- Date: 2025-10-26T02:38:57Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-ACCESS-SAUDI-ARABIA-SHOP-DASHBOARD)
- Screenshots:
- Threat Actors: Arabic
- Victim Country: Saudi Arabia
- Victim Industry: E-commerce & Online Stores
- Victim Organization: Unknown
- Victim Site: Unknown
51. Alleged Data Leak of France Citizens Database
- Category: Data Breach
- Content: The threat actor claims to have leaked a database of French citizens database containing 29.1 million records. The dataset reportedly includes personal and business information such as names, phone numbers, postal addresses, and company details.
- Date: 2025-10-26T02:30:34Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-%F0%9F%87%AB%F0%9F%87%B7France-citizens-DB-2025-10-18-29-1-million-rows)
- Screenshots:
- Threat Actors: Cayenne
- Victim Country: France
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
Conclusion
The cyber incident data gathered on October 26, 2025, reveals a highly diverse and geographically widespread threat landscape, with Data Breach incidents being the most prominent category alongside frequent Initial Access offerings and Ransomware attacks. Victims span numerous sectors, including Government Administration (Thailand, Mexico, UK, Uruguay), Education (Bangladesh, USA), Financial Services (Unknown logs), E-commerce, and Industrial Automation (Ukraine). This activity underscores a continuous and multifaceted threat, where actors are persistently seeking to monetize both confidential information and unauthorized network entry across the globe.
The sophistication of the attacks is notable, ranging from large-scale data leaks affecting millions of records, such as the 29.1 million French citizens database leak and 5 million Thai Department of Agricultural Extension records, to targeted operations like the Defacement campaigns against multiple government and educational sites in Bangladesh by “Trojan 1337”. Furthermore, threat actors demonstrated a keen interest in acquiring high-value assets, evidenced by the sale of admin access to systems in sectors like E-commerce (Saudi Arabia), Leisure & Travel (Turkey), and even core systems within Government Administration (Thailand). The listing of a Remote Code Execution (RCE) vulnerability for an Internet Service Provider in Bangladesh also highlights the continued trade in pre-cursor access and exploits.
Collectively, these incidents demonstrate that cyber adversaries are effectively targeting organizations of varying sizes and criticalities for financial gain, espionage, or ideological reasons. The high volume of ransomware attacks (e.g., PLAY, Qilin, DragonForce) indicates that data exfiltration coupled with extortion remains a primary threat. To mitigate this persistent risk, organizations must prioritize robust access controls, timely vulnerability management (especially for web-facing systems), and enhanced network segmentation to limit the lateral movement potential offered by initial access threats.