This report details a series of recent cyber incidents, providing key information for each event, including published URLs and associated screenshots, strictly based on the provided data.
1. Alleged data breach of EchoBase Services
- Category: Data Breach
- Content: The threat actor claims to have leaked the EchoBase Services database, offering a full dump of 300,000 rows that allegedly includes full names, emails, addresses, and other personal data.
- Date: 2025-10-30T23:56:42Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-echobase-hu-Database-Leaked-Download)
- Screenshots:
- Threat Actors: KaruHunters
- Victim Country: Hungary
- Victim Industry: Information Technology (IT) Services
- Victim Organization: echobase services
- Victim Site: echobase.hu
2. Alleged data breach of Nuovi Casino
- Category: Data Breach
- Content: Threat actor claims to have leaked database of Nuovi Casino, Italy. The compromised data reportedly includes ID, user login, user pass, user email, etc.
- Date: 2025-10-30T22:13:55Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Italy-Database-nuovicasino-it)
- Screenshots:
- Threat Actors: Robert2025
- Victim Country: Italy
- Victim Industry: Gambling & Casinos
- Victim Organization: nuovi casino
- Victim Site: nuovicasino.it
3. Alleged data breach of Oses
- Category: Data Breach
- Content: Threat actor claims to have leaked data from Oses, China.
- Date: 2025-10-30T22:06:06Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Database%C2%A0China-osens-cn)
- Screenshots:
- Threat Actors: Robert2025
- Victim Country: China
- Victim Industry: Management Consulting
- Victim Organization: oses
- Victim Site: osens.cn
4. BABAYO EROR SYSTEM targets the website of BPBJ Provinsi Lampung
- Category: Defacement
- Content: The group claims to have defaced the website of BPBJ Provinsi Lampung
- Date: 2025-10-30T21:28:02Z
- Network: telegram
- Published URL: (https://t.me/c/3159622829/474)
- Screenshots:
- Threat Actors: BABAYO EROR SYSTEM
- Victim Country: Indonesia
- Victim Industry: Government & Public Sector
- Victim Organization: bpbj provinsi lampung
- Victim Site: bpbj.lampungprov.go.id
5. Thompson Dorfman Sweatman LLP falls victim to Obscura Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 250 GB of organization’s data.
- Date: 2025-10-30T20:06:10Z
- Network: tor
- Published URL: (http://obscurad3aphckihv7wptdxvdnl5emma6t3vikcf3c5oiiqndq6y6xad.onion/leaks/13)
- Screenshots:
- Threat Actors: Obscura
- Victim Country: Canada
- Victim Industry: Legal Services
- Victim Organization: thompson dorfman sweatman llp
- Victim Site: tdslaw.com
6. Alleged sale of credit-card dataset
- Category: Data Breach
- Content: The threat actor claims to be selling credit-card dataset. The compromised data includes 15.000 records that includes name, address, city, email.
- Date: 2025-10-30T19:32:49Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/269313/)
- Screenshots:
- Threat Actors: cashmoneycard
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
7. Alleged data sale of Albany Physical Therapy
- Category: Data Breach
- Content: Threat actor claims to be selling leaked patients data from Albany Physical Therapy, USA. The compromised data reportedly contains name, birthdate, full address, phone, email, etc.
- Date: 2025-10-30T19:30:17Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-1GB-Records-of-Patients-from-Albany-Physical-Therapy-Clinic-%E2%80%93-Fresh-and-Real)
- Screenshots:
- Threat Actors: sentap
- Victim Country: USA
- Victim Industry: Hospital & Health Care
- Victim Organization: albany physical therapy
- Victim Site: albanesephysicaltherapy.com
8. Alleged sale of verified company phone-number list
- Category: Data Breach
- Content: The threat actor claims to be selling verified list of company phone numbers from USA. The compromised data includes 3266431 records.
- Date: 2025-10-30T19:22:11Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/269309/)
- Screenshots:
- Threat Actors: xids
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
9. Alleged sale of verified phone numbers of shopping-service consumers in the United States
- Category: Data Breach
- Content: A threat actor claims to be selling a verified list of phone numbers belonging to consumers of shopping services in the USA. The compromised data includes 660664 records.
- Date: 2025-10-30T19:12:37Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/269308/)
- Screenshots:
- Threat Actors: xids
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
10. Alleged sale of access to unidentified Insurance company based in France
- Category: Initial Access
- Content: Threat actor claims to be selling unauthorized RCE access to an unidentified insurance company based in France.
- Date: 2025-10-30T19:08:51Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-RCE-2-5B-Insurance-Company)
- Screenshots:
- Threat Actors: haxorsss
- Victim Country: France
- Victim Industry: Insurance
- Victim Organization: Unknown
- Victim Site: Unknown
11. Alleged sale of Verified Shopping Email List from public leaks
- Category: Data Breach
- Content: The threat actor claims to be selling Verified Shopping Email List from public leaks. The compromised data includes 4937425 records.
- Date: 2025-10-30T19:03:47Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/269307/)
- Screenshots:
- Threat Actors: xids
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
12. Alleged sale of Verified Crypto Email List from public leaks
- Category: Data Breach
- Content: The threat actor claims to be selling Verified Crypto Email List from public leaks. The compromised data includes 7319264 records.
- Date: 2025-10-30T18:57:28Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/269306/)
- Screenshots:
- Threat Actors: xids
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
13. Weber Water Resources falls victim to Metaencryptor Team ransomware
- Category: Ransomware
- Content: Group claims to have obtained 38GB of organization’s data.
- Date: 2025-10-30T18:41:24Z
- Network: tor
- Published URL: (https://metacrptmytukkj7ajwjovdpjqzd7esg5v3sg344uzhigagpezcqlpyd.onion/)
- Screenshots:
- Threat Actors: Metaencryptor Team
- Victim Country: USA
- Victim Industry: Building and construction
- Victim Organization: weber water resources
- Victim Site: weberwaterresources.com
14. CMG Constructions Métalliques Grésillon falls victim to Sinobi ransomware
- Category: Ransomware
- Content: The group claims to have obtained 150 GB of the organization’s data. The compromised data includes Financial data, Customer’s data, Contracts.
- Date: 2025-10-30T18:32:15Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/6903a40388b6823fa2094e7e)
- Screenshots:
- Threat Actors: Sinobi
- Victim Country: France
- Victim Industry: Building and construction
- Victim Organization: cmg constructions métalliques grésillon
- Victim Site: cmgresillon.fr
15. Ansell falls victim to CL0P Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s sensitive data.
- Date: 2025-10-30T18:20:36Z
- Network: tor
- Published URL: (http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/ansell-com)
- Screenshots:
- Threat Actors: CL0P
- Victim Country: Australia
- Victim Industry: Manufacturing
- Victim Organization: ansell
- Victim Site: ansell.com
16. Post Ranch Inn falls victim to Sinobi ransomware
- Category: Ransomware
- Content: The group claims to have obtained 150 GB of the organization’s data. The compromised data includes Customer’s data, Financial data.
- Date: 2025-10-30T18:06:32Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/6903a51088b6823fa209516f)
- Screenshots:
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Hospitality & Tourism
- Victim Organization: post ranch inn
- Victim Site: postranchinn.com
17. Alleged Data Breach of SOAS University of London
- Category: Data Breach
- Content: The threat actor claims to be breached data from SOAS University of London.
- Date: 2025-10-30T17:52:58Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/269300/)
- Screenshots:
- Threat Actors: BIG-BROTHER
- Victim Country: UK
- Victim Industry: Higher Education/Acadamia
- Victim Organization: soas university of london
- Victim Site: soas.ac.uk
18. Latcom falls victim to Black Nevas Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data.
- Date: 2025-10-30T17:51:51Z
- Network: tor
- Published URL: (http://ctyfftrjgtwdjzlgqh4avbd35sqrs6tde4oyam2ufbjch6oqpqtkdtid.onion/publications/details/afe59218-dbee-45c0-8f24-d5ed56f2debb)
- Screenshots:
- https://d34iuop8pidsy8.cloudfront.net/0598b0dd-34e7-46f4-8efb-8aafaa3f0631.png
- https://d34iuop8pidsy8.cloudfront.net/cf70606a-db3e-49ab-b6b1-85605fb2edd4.png
- https://d34iuop8pidsy8.cloudfront.net/22819c75-0ced-4421-b025-7f1cb88859f6.png
- https://d34iuop8pidsy8.cloudfront.net/535a658a-96c5-4dcd-858d-6f62cd4a73c8.png
- Threat Actors: Black Nevas
- Victim Country: Argentina
- Victim Industry: Marketing, Advertising & Sales
- Victim Organization: latcom
- Victim Site: latcom.com
19. Alleged data sale of SOAS University of London
- Category: Data Breach
- Content: Threat actor claims to be selling leaked database of SOAS University of London, UK.
- Date: 2025-10-30T17:50:01Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-UK-DB-of-SOAS-University-Soas-ac-uk)
- Screenshots:
- Threat Actors: BIGBROTHER
- Victim Country: UK
- Victim Industry: Higher Education/Acadamia
- Victim Organization: soas university of london
- Victim Site: soas.ac.uk
20. Disseny Dental falls victim to Qilin ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data.
- Date: 2025-10-30T17:27:45Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=e8a39099-f284-33a7-a9fc-226805ea5e2d)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: Spain
- Victim Industry: Hospital & Health Care
- Victim Organization: disseny dental
- Victim Site: dissenydental.com
21. FA Servers Inc. fallls victim to Qilin ransomware
- Category: Ransomware
- Content: The group claims to have obtained 10 GB of the organization’s data.
- Date: 2025-10-30T17:20:06Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=f17c4c0d-fe35-39fd-9822-974348b1a75c)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: Canada
- Victim Industry: Information Technology (IT) Services
- Victim Organization: fa servers inc.
- Victim Site: faserver.ca
22. CNLD Neuropsychology fallls victim to Qilin ransomware
- Category: Ransomware
- Content: The group claims to have obtained 150 GB of the organization’s data.
- Date: 2025-10-30T17:14:14Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=31bb096b-a75d-33c2-a3e9-95ea96fd2d8c)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: USA
- Victim Industry: Mental Health Care
- Victim Organization: cnld neuropsychology
- Victim Site: cnld.org
23. Alleged data breach of TVRI JAWA TIMUR INDONESIA
- Category: Data Breach
- Content: The group claims to have obtained Employee Data of TVRI JAWA TIMUR INDONESIA.
- Date: 2025-10-30T16:49:10Z
- Network: telegram
- Published URL: (https://t.me/c/3159622829/473)
- Screenshots:
- Threat Actors: BABAYO EROR SYSTEM
- Victim Country: Indonesia
- Victim Industry: Broadcast Media
- Victim Organization: tvri jawa timur indonesia
- Victim Site: Unknown
24. Alleged Data Breach of deutsche welle
- Category: Data Breach
- Content: The threat actor claims to be breached data from deutsche welle. The compromised data reportedly contains database dump of 15 subdomains.
- Date: 2025-10-30T16:27:56Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/269294/)
- Screenshots:
- Threat Actors: BIG-BROTHER
- Victim Country: Germany
- Victim Industry: Broadcast Media
- Victim Organization: deutsche welle
- Victim Site: dw.com
25. Anderson Moore Construction Corp. falls victim to Qilin ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data.
- Date: 2025-10-30T16:09:33Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=d9a38f59-f4a0-393c-af94-129bb0276ced)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: USA
- Victim Industry: Building and construction
- Victim Organization: anderson moore construction corp.
- Victim Site: amcbuild.com
26. Alleged Data Breach of Envia Colombia
- Category: Data Breach
- Content: The threat actor claims to be breached data of Envia Colombia. The compromised data reportedly includes 500 gb of data and also including internal databases, administrative credentials, and source code.
- Date: 2025-10-30T16:06:10Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/envia-colombia-data-leak-500gb.45024/)
- Screenshots:
- Threat Actors: CryptoDead
- Victim Country: Colombia
- Victim Industry: Transportation & Logistics
- Victim Organization: envia.com
- Victim Site: envia.com
27. Saxun by Giménez Ganga falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained 320 GB of the organization’s data. The compromised data includes Lots of projects and clients files, drawings and specifications, employee information, lots of contracts, NDA.
- Date: 2025-10-30T16:03:49Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: Spain
- Victim Industry: Building and construction
- Victim Organization: saxun by giménez ganga
- Victim Site: saxun.com
28. Architectural Systems Inc. falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained 355 GB of the organization’s data. The compromised data includes Numerous confidential files of clients (drawings of building, security systems),customer information, accounting information, contracts and agreements, client information and so on.
- Date: 2025-10-30T16:00:03Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Wholesale
- Victim Organization: architectural systems inc.
- Victim Site: asi-sd.com
29. SYLHET GANG-SG claims to target the UAE
- Category: Alert
- Content: A recent post by the group claims they are targeting the UAE, and UAE citizens passports will be leaked soon.
- Date: 2025-10-30T15:51:46Z
- Network: telegram
- Published URL: (https://t.me/SylhetGangSG1/7077)
- Screenshots:
- Threat Actors: SYLHET GANG-SG
- Victim Country: UAE
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
30. Alleged data sale of YAS Takaful
- Category: Data Breach
- Content: The threat actor claims to be selling over 450,000 lines of data from YAS Takaful. The compromised information reportedly includes client data such as names, dates of birth, phone numbers, email addresses, and more.
- Date: 2025-10-30T14:16:00Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-SELLING-Yas-Takaful-Dubai-Insurance)
- Screenshots:
- Threat Actors: ByteToBreach
- Victim Country: UAE
- Victim Industry: Insurance
- Victim Organization: yas takaful
- Victim Site: yastakaful.ae
31. Buffalo Games falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained 34 GB of the organization’s data. The compromised information reportedly includes employee docs such as passports, driver licenses, social security cards, w-9 forms, accounting information, contracts and agreements, client information.
- Date: 2025-10-30T14:08:51Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Retail Industry
- Victim Organization: buffalo games
- Victim Site: buffalogames.com
32. Boilersource falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data. The compromised information reportedly includes Employees personal information such as addresses, phones, DOB, driver licenses, social security cards, credit cards insurance forms with personal information, accounting information, contracts and agreements, NDA etc.
- Date: 2025-10-30T13:55:12Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Electrical & Electronic Manufacturing
- Victim Organization: meilner mechanical sales
- Victim Site: boilersource.com
33. Sullivan Brothers Family of Companies falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained 40 GB of the organization’s data. The compromised information reportedly includes Employees personal information such as passports, addresses, phones, DOB, driver licenses, social security cards, w-9 forms, accounting information, contracts and agreements, incidents and police reports and so on.
- Date: 2025-10-30T13:39:20Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Building and construction
- Victim Organization: sullivan brothers family of companies
- Victim Site: sullbros.com
34. Trojan 1337 targets the website of Mirzakhil High School and College
- Category: Defacement
- Content: The group claims to have defaced the website of Mirzakhil High School and College Mirror: https://ownzyou.com/zone/276005
- Date: 2025-10-30T13:36:59Z
- Network: telegram
- Published URL: (https://t.me/c/2805167925/79)
- Screenshots:
- Threat Actors: Trojan 1337
- Victim Country: Bangladesh
- Victim Industry: Education
- Victim Organization: mirzakhil high school and college
- Victim Site: mirzakhilhs.edu.bd
35. HMEI7 targets The Ribbon Artist
- Category: Ransomware
- Content: The threat actor claims to have deployed ransomware against The Ribbon Artist and encrypted all of its files. NB: The authenticity of the claim is yet to be verified.
- Date: 2025-10-30T13:12:47Z
- Network: telegram
- Published URL: (https://t.me/c/2412030007/1826)
- Screenshots:
- Threat Actors: HMEI7
- Victim Country: India
- Victim Industry: Retail Industry
- Victim Organization: the ribbon artist
- Victim Site: ribbonartist.erainfoservices.in
36. HEB Advisors falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained 66 GB of the organization’s data. The compromised information reportedly includes a large amount of personal data belonging to clients and employees, as well as detailed accounting information and internal confidential files.
- Date: 2025-10-30T13:03:12Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Accounting
- Victim Organization: heb advisors
- Victim Site: hebadvisors.com
37. Alleged data breach of MAYA Technologies Ltd.
- Category: Data Breach
- Content: The group claims to have breached MAYA Technologies Ltd. The compromised data reportedly includes phone conversations, meetings, and, every rocket, plane, vehicle, and system designed., also they claims that they breached 10TB data from 17 institutions and companies that directly and indirectly serve the Israel defense and military industries, personal data, administrative and technical documents, audio calls, and video recordings. NB: The authenticity of the claim is yet to be verified
- Date: 2025-10-30T12:47:19Z
- Network: telegram
- Published URL: (https://t.me/CyberToufan08/371)
- Screenshots:
- Threat Actors: CyberToufan
- Victim Country: Israel
- Victim Industry: Machinery Manufacturing
- Victim Organization: maya technologies ltd.
- Victim Site: maya-il.com
38. Alleged Sale of Unauthorized FTP Access to a U.S. Corporation
- Category: Initial Access
- Content: The threat actor claims to be selling admin-level FTP access belonging to an unidentified corporation based in the United States. The organization reportedly operates in the corporate sector with an estimated revenue of $4.6 billion. The listing indicates that the access includes over 10,000 files totaling more than 5 TB of data.
- Date: 2025-10-30T12:44:05Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-FTP-ACCESS-4-6B-CORP)
- Screenshots:
- Threat Actors: Dark_Alpha
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
39. Alleged data breach of metstroysetka
- Category: Data Breach
- Content: The threat actor claims to have leaked a database from Metstroysetka, allegedly containing information such as ID, discount, discount type, date added, status, full name, email, phone number, city, city text, and more.
- Date: 2025-10-30T12:20:08Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-metstroysetka-ru-Russian-Database)
- Screenshots:
- Threat Actors: Robert2025
- Victim Country: Russia
- Victim Industry: Building and construction
- Victim Organization: metstroysetka
- Victim Site: metstroysetka.ru
40. Apache OpenOffice falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained 23 GB of the organization’s data. The compromised information reportedly includes employee data, as well as financial records and internal confidential files.
- Date: 2025-10-30T12:10:43Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Software
- Victim Organization: apache openoffice
- Victim Site: openoffice.org
41. Econo-Pak falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data. The compromised data includes financial data such as audit, payment details, invoices, detailed employees and customers information (emails, phones) and other documents with detailed personal information.
- Date: 2025-10-30T12:09:57Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Packaging & Containers
- Victim Organization: ransomware
- Victim Site: econo-pak.com
42. Alleged unauthorized access to Energy Installation Control System in Italy
- Category: Initial Access
- Content: The group claims to have gained full administrative access to an energy installation control system in Italy, which reportedly controls PID controllers, emergency alerts, temperature/pressure/power parameters, valves, pumps, switches, generator settings, and the accident/failure logging systems.
- Date: 2025-10-30T11:41:26Z
- Network: telegram
- Published URL: (https://t.me/c/2787466017/74)
- Screenshots:
- Threat Actors: NoName057(16)
- Victim Country: Italy
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
43. Gerson falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data. The compromised data includes financial data such as audit, payment details, financial reports, invoices, detailed employees and customers information includes medical information, emails, phones and other documents with detailed personal information.
- Date: 2025-10-30T11:40:53Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Manufacturing
- Victim Organization: gerson
- Victim Site: gersonco.com
44. RPI Roofing falls victim to akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained 90 GB of organization’s data. The compromised data includes employee information such as addresses, phones, DOB, driver licenses, social security cards, financial information, internal confidential files, NDA, etc.
- Date: 2025-10-30T11:36:00Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Building and construction
- Victim Organization: rpi roofing
- Victim Site: rpiroof.com
45. Askul falls victim to RansomHouse Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data.
- Date: 2025-10-30T11:12:10Z
- Network: tor
- Published URL: (http://zohlm7ahjwegcedoz7lrdrti7bvpofymcayotp744qhx6gjmxbuo2yid.onion/r/001dc0c08b5617ff64e7180034784bd6a24ce8a9)
- Screenshots:
- Threat Actors: RansomHouse
- Victim Country: Japan
- Victim Industry: Retail Industry
- Victim Organization: askul
- Victim Site: askul.co.jp
46. HEZI RASH targets the website of Poland
- Category: Defacement
- Content: The group claims to have deface the website of Poland.
- Date: 2025-10-30T10:28:16Z
- Network: telegram
- Published URL: (https://t.me/hezi_rash/236)
- Screenshots:
- Threat Actors: HEZI RASH
- Victim Country: Poland
- Victim Industry: Unknown
- Victim Organization: serwer2555479.home.pl
- Victim Site: serwer2555479.home.pl
47. Alleged sale of unauthorized access to an unidentified organization in Spain
- Category: Initial Access
- Content: The threat actor claims to be selling one unauthorized RDP access belonging to an unidentified organization based in Spain. The organization operates within the Government Administration sector and reportedly has a revenue of 16.9 million.
- Date: 2025-10-30T10:27:50Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-16-9-million-and-29-9-million-RDP-access)
- Screenshots:
- Threat Actors: ledger
- Victim Country: Spain
- Victim Industry: Government Administration
- Victim Organization: Unknown
- Victim Site: Unknown
48. HEZI RASH targets the website of TimRadio
- Category: Defacement
- Content: The group claims to have deface the website of TimRadio
- Date: 2025-10-30T10:18:00Z
- Network: telegram
- Published URL: (https://t.me/hezi_rash/237)
- Screenshots:
- Threat Actors: HEZI RASH
- Victim Country: Romania
- Victim Industry: Broadcast Media
- Victim Organization: timradio
- Victim Site: timradio.hi2.ro
49. Alleged data sale of Pruksa Family Club
- Category: Data Breach
- Content: The threat actor claims to be selling 476.0 MB of CSV data from Pruksa Inc. The compromised data The compromised dataset contains 463577 names, 460106 emails, 154315 MD5 hashed passwords, 417843 phone numbers and 35831 DOB.
- Date: 2025-10-30T08:18:16Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Thailand-460k-Name-Email-Password-Hash-Phone-Dob-pruksa-com)
- Screenshots:
- Threat Actors: AgSlowly
- Victim Country: Thailand
- Victim Industry: Real Estate
- Victim Organization: pruksa family club
- Victim Site: pruksa.com
50. Alleged data leak of Institute of Quality Technical Safety Management
- Category: Data Breach
- Content: The threat actor claims to be leaked data from Institute of Quality Technical Safety Management. The compromised data includes email addresses, full names, phone numbers, register IDs, and course name.
- Date: 2025-10-30T08:13:05Z
- Network: telegram
- Published URL: (https://t.me/c/2758066065/124)
- Screenshots:
- Threat Actors: HellR00ters Team
- Victim Country: India
- Victim Industry: Education
- Victim Organization: institute of quality technical safety management
- Victim Site: iqtsindia.com
51. Alleged unauthorized access to Aeronautical Radio of Thailand Ltd
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to Aeronautical Radio of Thailand Ltd.
- Date: 2025-10-30T07:22:42Z
- Network: telegram
- Published URL: (https://t.me/nxbbsec/2967)
- Screenshots:
- Threat Actors: NXBB.SEC
- Victim Country: Thailand
- Victim Industry: Aviation & Aerospace
- Victim Organization: aeronautical radio of thailand ltd
- Victim Site: aerothai.co.th
52. Alleged data leak of CSN Financial Cooperative
- Category: Data Breach
- Content: The threat actor claims to be selling 3.79 GB of customer data from CSN Financial Cooperative. The compromised data includes email addresses, full names, phone numbers, user IDs, and more.
- Date: 2025-10-30T07:18:41Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-MX-CSN-Cooperativa-Financiera)
- Screenshots:
- Threat Actors: icarus
- Victim Country: Mexico
- Victim Industry: Financial Services
- Victim Organization: csn financial cooperative
- Victim Site: csn.coop
53. Alleged unauthorized access to unidentified Australia and U.S. based Water Distribution Control System
- Category: Initial Access
- Content: Group claims to have gained unauthorized access to Australia and U.S. based water distribution control systems. The systems reportedly manage well and booster pumps, reservoir levels, valve actuators, and associated pressure-control equipment many operating in fully automatic mode via PLCs and variable frequency drives (VFDs).
- Date: 2025-10-30T04:21:44Z
- Network: telegram
- Published URL: (https://t.me/n2LP_wVf79c2YzM0/2185)
- Screenshots:
- Threat Actors: Infrastructure Destruction Squad
- Victim Country: Australia
- Victim Industry: Industrial Automation
- Victim Organization: Unknown
- Victim Site: Unknown
54. Alleged data breach of Privatization Holding Company
- Category: Data Breach
- Content: A threat actor has claims to have leaked data from Privatization Holding Company, a Jordanian company in the energy and utilities sector. The compromised data includes portion of the company’s source code which may include internal software files, system structures, and proprietary scripts used in Privatization Holding Company operations and made available for download.
- Date: 2025-10-30T04:06:38Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Source-Code-PHC-com-jo-Data-Breach-Leaked-Download)
- Screenshots:
- Threat Actors: 888
- Victim Country: Jordan
- Victim Industry: Manufacturing
- Victim Organization: privatization holding company
- Victim Site: phc.com.jo
55. Alleged data breach of SkoolBeep
- Category: Data Breach
- Content: The threat actor claims to be a leaked database of SkoolBeep, an education technology platform used by over 1,500 schools.
- Date: 2025-10-30T02:54:59Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Source-Code-SkoolBeep-Data-Breach-Leaked-Download)
- Screenshots:
- Threat Actors: 888
- Victim Country: India
- Victim Industry: Education
- Victim Organization: skoolbeep
- Victim Site: skoolbeep.com
56. Alleged data leak of 1,050 US CVV2 card records
- Category: Data Breach
- Content: The threat actor claims to be a leaked database of US cardholder CVV2 records.
- Date: 2025-10-30T02:40:46Z
- Network: openweb
- Published URL: (https://forum.exploit.in/topic/269237/)
- Screenshots:
- Threat Actors: thisisjack
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
57. ApleNet Co., Ltd falls victim to BlackShrantac Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 250 GB of the organization’s data, including firewall logs from vendors such as Palo Alto and Juniper, competition-related documents, and network architecture and PoC data from partners and customers. The stolen files also reportedly include technical cybersecurity materials and educational resources.
- Date: 2025-10-30T02:32:02Z
- Network: tor
- Published URL: (http://jvkpexgkuaw5toiph7fbgucycvnafaqmfvakymfh5pdxepvahw3xryqd.onion/targets/21)
- Screenshots:
- Threat Actors: BlackShrantac
- Victim Country: South Korea
- Victim Industry: Information Technology (IT) Services
- Victim Organization: aplenet co., ltd
- Victim Site: aplenet.co.kr
58. Evolve Mortgage Services, LLC falls victim to INC RANSOM Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 20 TB of the organization’s data, including 2 TB of databases containing sensitive customer information. The stolen data reportedly includes Social Security numbers, scans of client IDs, home and work addresses, personal and work phone numbers, full credit histories, and confidential PII forms dating back to 2016.
- Date: 2025-10-30T01:58:59Z
- Network: tor
- Published URL: (http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures/68ff418ce1a4e4b3ff674713)
- Screenshots:
- Threat Actors: INC RANSOM
- Victim Country: USA
- Victim Industry: Financial Services
- Victim Organization: evolve mortgage services, llc
- Victim Site: evolvemortgageservices.com
59. BABAYO EROR SYSTEM targets the website of CareLinks Organization
- Category: Defacement
- Content: The group claims to have defaced the website of CareLinks Organization.
- Date: 2025-10-30T00:49:59Z
- Network: telegram
- Published URL: (https://t.me/c/3159622829/418)
- Screenshots:
- Threat Actors: BABAYO EROR SYSTEM
- Victim Country: Canada
- Victim Industry: Hospital & Health Care
- Victim Organization: carelinks organization
- Victim Site: carelinkshealth.org
60. National Coatings, Inc. falls victim to LYNX Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s internal data. Note: National Coatings, Inc. has previously fallen victim to PLAY Ransomware on October 21, 2025.
- Date: 2025-10-30T00:34:11Z
- Network: tor
- Published URL: (http://lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion/leaks/690140502423bc3ce02c28b9)
- Screenshots:
- Threat Actors: LYNX
- Victim Country: USA
- Victim Industry: Building and construction
- Victim Organization: national coatings, inc.
- Victim Site: nationalcoatingsinc.com
61. alleged data breach of FBI
- Category: Data Breach
- Content: A threat actor claims to have leaked data from FBI. The compromised data includes leaders home addresses, fbi.gov email and password pairs, and other personal details, and is offering additional government/military data for sale.
- Date: 2025-10-30T00:03:26Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-%F0%9F%95%B5%EF%B8%8F-MAJOR-FBI-LEAK-LEADERS-HOME-ADDRESS-MAILS-%F0%9F%95%B5%EF%B8%8F)
- Screenshots:
- Threat Actors: jrintel
- Victim Country: USA
- Victim Industry: Government & Public Sector
- Victim Organization: federal bureau of investigation (fbi)
- Victim Site: fbi.gov
The incidents from the provided data indicate a highly active and diversified cyber threat landscape across numerous global sectors. Data Breach remains the most prevalent attack category, with threat actors frequently offering for sale or leaking personally identifiable information (PII), including emails, phone numbers, addresses, and in some cases, highly sensitive financial or medical records. Notable victims of data compromises include organizations in IT Services (EchoBase Services, ApleNet Co.) , Financial Services (Evolve Mortgage Services, CSN Financial Cooperative) , Education (SOAS University of London, SkoolBeep) , and Government entities (Federal Bureau of Investigation-FBI). The volume of data being monetized is significant, including the alleged sale of over 7 million crypto-related emails and 3.2 million company phone numbers in the USA, illustrating a booming underground market for mass consumer and business data.
The threat from Ransomware is also extensive, impacting critical infrastructure and major organizations across multiple countries, with the Akira ransomware group being particularly prolific, listing 14 victims in this batch alone. Industries heavily targeted by ransomware and extortion are Building and Construction and Manufacturing. Beyond data theft and encryption, the trade in Initial Access continues, with offerings for unauthorized RCE access to a French insurance company and administrative access to a water distribution control system affecting both the US and Australia. This combination of mass data leakage, aggressive ransomware deployment, and targeted initial access sales highlights the need for robust defensive measures focused on data classification, network segmentation, and strong access controls across all sectors.