This report details a series of recent cyber incidents, providing key information for each event, including published URLs and associated screenshots, strictly based on the provided data.
1. SIAD S.p.A. falls victim to Everest Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 159 GB of the organization’s internal data and intends to publish it within 10 days.
- Date: 2025-11-10T23:39:25Z
- Network: tor
- Published URL: (http://ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion/news/SIAD/)
- Screenshots:
- Threat Actors: Everest
- Victim Country: Italy
- Victim Industry: Chemical Manufacturing
- Victim Organization: siad s.p.a.
- Victim Site: siad.com
2. Agfa-Gevaert Group (AGFA) falls victim to Everest Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 354 GB of the organization’s internal data and intends to publish it within 10 days.
- Date: 2025-11-10T23:29:08Z
- Network: tor
- Published URL: (http://ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion/news/AGFA/)
- Screenshots:
- Threat Actors: Everest
- Victim Country: Belgium
- Victim Industry: Manufacturing & Industrial Products
- Victim Organization: agfa-gevaert group
- Victim Site: agfa.com
3. HEZI RASH claims to target surveillance cameras in Turkey
- Category: Alert
- Content: A recent post by the group claims they are targeting surveillance cameras in Turkey
- Date: 2025-11-10T22:57:36Z
- Network: telegram
- Published URL: (https://t.me/c/3058168654/279)
- Screenshots:
- Threat Actors: HEZI RASH
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
4. Alleged leak of admin access to IOtech
- Category: Initial Access
- Content: The threat actor claims to have gained unauthorized admin access to IOtech
- Date: 2025-11-10T22:09:30Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Admin-access-to-the-Saudi-iotech-sa-site)
- Screenshots:
- Threat Actors: blackhunter1
- Victim Country: Saudi Arabia
- Victim Industry: Computer Hardware
- Victim Organization: iotech
- Victim Site: iotech.sa
5. Alleged data breach of Kantenna Technology Limited
- Category: Data Breach
- Content: Group claims to have leaked data from Kantenna Technology Limited.
- Date: 2025-11-10T22:02:52Z
- Network: telegram
- Published URL: (https://t.me/MoroccanCyberSentinelsOfficial/1429)
- Screenshots:
- Threat Actors: Moroccan Cyber Sentinels
- Victim Country: China
- Victim Industry: Network & Telecommunications
- Victim Organization: kantenna technology limited
- Victim Site: kantennatech.com
6. Alleged sale of Beckett Collectibles database
- Category: Data Breach
- Content: The threat actor claims to be selling the database of Beckett Collectibles.
- Date: 2025-11-10T21:44:31Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-beckett-com-database-for-sale-on-bstars)
- Screenshots:
- Threat Actors: brainee
- Victim Country: USA
- Victim Industry: E-commerce & Online Stores
- Victim Organization: beckett collectibles
- Victim Site: beckett.com
7. Community Unit School District 201 falls victim to INC RANSOM Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization data.
- Date: 2025-11-10T21:22:07Z
- Network: tor
- Published URL: (http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures/69124fdae1a4e4b3ffa16be6)
- Screenshots:
- Threat Actors: INC RANSOM
- Victim Country: USA
- Victim Industry: Education
- Victim Organization: community unit school district 201
- Victim Site: cusd201.org
8. Easterseals Northeast Indiana falls victim to INC RANSOM Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 405 GB organization data.
- Date: 2025-11-10T21:13:16Z
- Network: tor
- Published URL: (http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures/69124d93e1a4e4b3ffa13f22)
- Screenshots:
- Threat Actors: INC RANSOM
- Victim Country: USA
- Victim Industry: Individual & Family Services
- Victim Organization: easterseals northeast indiana
- Victim Site: eastersealsnei.org
9. Island Engineering Ltd. falls victim to SAFEPAY Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data.
- Date: 2025-11-10T21:00:04Z
- Network: tor
- Published URL: (http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/ielplumbingcom/)
- Screenshots:
- Threat Actors: SAFEPAY
- Victim Country: Unknown
- Victim Industry: Building and construction
- Victim Organization: island engineering ltd.
- Victim Site: ielplumbing.com
10. Alleged data leak of Allianz
- Category: Data Breach
- Content: Threat actor claims to have leaked data from Allianz. The leak reportedly contains over 3 million records, including Number, Index, Stock Buyback, Name, Gender, Age Range, Term, Increase, Allianz Shares, Currency, etc.
- Date: 2025-11-10T20:40:33Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-%E3%80%90Germany%E3%80%91Allianz-Group-Insurance-Life-Credit-Card-Property-Securities-Investment)
- Screenshots:
- Threat Actors: yeestge33
- Victim Country: Germany
- Victim Industry: Financial Services
- Victim Organization: allianz
- Victim Site: allianz.com
11. Yaesu falls victim to Qilin ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization data.
- Date: 2025-11-10T20:26:29Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=d2063641-fa1a-34c8-ab26-31c8adaf75af)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: Japan
- Victim Industry: Manufacturing
- Victim Organization: yaesu
- Victim Site: yaesu.com
12. Alleged data breach of Blavity Inc.
- Category: Data Breach
- Content: The threat actor claims to be selling data from Blavity Inc., with approximately 1.2 million records reportedly compromised.
- Date: 2025-11-10T20:10:38Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-NEW-BREACH-PREVIEW-BLAVITY-INC-1-12-million)
- Screenshots:
- Threat Actors: FulcrumSec
- Victim Country: USA
- Victim Industry: Information Technology (IT) Services
- Victim Organization: blavity inc.
- Victim Site: blavityinc.com
13. Ioxo falls victim to PLAY ransomware
- Category: Ransomware
- Content: Group claims to have obtained organizational data and plans to publish it within 3-4 days. The compromised data reportedly includes private and personal confidential data, clients documents, budget, payroll, IDs, taxes, finance information and etc.
- Date: 2025-11-10T20:03:05Z
- Network: tor
- Published URL: (http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion/topic.php?id=3Fi58Zt2VHQ8vR)
- Screenshots:
- Threat Actors: PLAY
- Victim Country: USA
- Victim Industry: Information Technology (IT) Services
- Victim Organization: ioxo
- Victim Site: ioxo.cloud
14. Garvin Promotion Group falls victim to PLAY ransomware
- Category: Ransomware
- Content: Group claims to have obtained organizational data and plans to publish it within 4–5 days. The compromised data reportedly includes private and personal confidential data, clients documents, budget, payroll, IDs, taxes, finance information and etc.
- Date: 2025-11-10T19:49:58Z
- Network: tor
- Published URL: (http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion/topic.php?id=c495I0HniypHuV)
- Screenshots:
- Threat Actors: PLAY
- Victim Country: USA
- Victim Industry: Consumer Services
- Victim Organization: garvin promotion group
- Victim Site: garvinpromo.com
15. Alleged leak of Buisness Leaders Database from Russia
- Category: Data Breach
- Content: The threat actor claims to have leaked Buisness Leaders Database from Russia.
- Date: 2025-11-10T19:44:26Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Russia-Buisness-Leaders-Database-%F0%9F%87%B7%F0%9F%87%BA)
- Screenshots:
- Threat Actors: Databroque
- Victim Country: Russia
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
16. Jean-Georges Management falls victim to PLAY ransomware
- Category: Ransomware
- Content: Group claims to have obtained organizational data and plans to publish it within 4–5 days. The compromised data reportedly includes private and personal confidential data, clients documents, budget, payroll, IDs, taxes, finance information and etc.
- Date: 2025-11-10T19:40:33Z
- Network: tor
- Published URL: (http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion/topic.php?id=4cf8V4luKMLWsu)
- Screenshots:
- Threat Actors: PLAY
- Victim Country: USA
- Victim Industry: Restaurants
- Victim Organization: jean-georges management
- Victim Site: jean-georges.com
17. Kwik Mix Materials falls victim to PLAY ransomware
- Category: Ransomware
- Content: Group claims to have obtained organizational data and plans to publish it within 3-4 days. The compromised data reportedly includes private and personal confidential data, clients documents, budget, payroll, IDs, taxes, finance information and etc.
- Date: 2025-11-10T19:29:18Z
- Network: tor
- Published URL: (http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion/topic.php?id=0Gc1LIiBepSjA)
- Screenshots:
- Threat Actors: PLAY
- Victim Country: Canada
- Victim Industry: Building and construction
- Victim Organization: kwik mix materials
- Victim Site: kwikmix.com
18. Darvin Furniture & Mattress falls victim to PLAY ransomware
- Category: Ransomware
- Content: Group claims to have obtained organizational data and plans to publish it within 3-4 days. The compromised data reportedly includes private and personal confidential data, clients documents, budget, payroll, IDs, taxes, finance information and etc.
- Date: 2025-11-10T19:22:00Z
- Network: tor
- Published URL: (http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion/topic.php?id=HWGrjd61QVH2Ky)
- Screenshots:
- Threat Actors: PLAY
- Victim Country: USA
- Victim Industry: Furniture
- Victim Organization: darvin furniture & mattress
- Victim Site: darvin.com
19. Land Title Guaranty falls victim to PLAY ransomware
- Category: Ransomware
- Content: Group claims to have obtained organizational data and plans to publish it within 3-4 days. The compromised data reportedly includes private and personal confidential data, clients documents, budget, payroll, IDs, taxes, finance information and etc.
- Date: 2025-11-10T19:17:40Z
- Network: tor
- Published URL: (http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion/topic.php?id=L4wM1CDX0I6hyS)
- Screenshots:
- Threat Actors: PLAY
- Victim Country: USA
- Victim Industry: Real Estate
- Victim Organization: land title guaranty
- Victim Site: landtitleweb.com
20. Alleged data breach of Cancard Inc.
- Category: Data Breach
- Content: The threat actor claims to be selling data from Cancard Inc.
- Date: 2025-11-10T18:56:29Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/cancard-db-avilable-on-priva1e-channe1-to-b0y-acces-dm-telgram.45672/)
- Screenshots:
- Threat Actors: jdudjbdd
- Victim Country: Canada
- Victim Industry: Medical Equipment Manufacturing
- Victim Organization: cancard inc.
- Victim Site: cancard.com
21. Alleged leak of sensitive confidential documents from Syria and USA
- Category: Data Breach
- Content: Threat actor claims to have leaked sensitive confidential documents from Syria and USA.
- Date: 2025-11-10T18:43:12Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Document-%F0%9F%AA%90-TOP-SECRET-SYRIA-USA-DOCUMENTS-LEAKED-FULL-SYRIA-IS-ADMIN-LEAK-CRAZY-%F0%9F%AA%90)
- Screenshots:
- Threat Actors: jrintel
- Victim Country: Syria
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
22. Alleged leak of SYRIA/USA DOCUMENTS
- Category: Data Breach
- Content: Threat actor claims to have leaked SYRIA/USA DOCUMENTS.
- Date: 2025-11-10T18:36:23Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Document-%F0%9F%AA%90-TOP-SECRET-SYRIA-USA-DOCUMENTS-LEAKED-FULL-SYRIA-IS-ADMIN-LEAK-CRAZY-%F0%9F%AA%90)
- Screenshots:
- Threat Actors: jrintel
- Victim Country: Syria
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
23. Alleged leak of sensitive data from India
- Category: Data Breach
- Content: Threat actor claims to have leaked sensitive data from India, including challan details, names, mobile numbers, addresses, and more.
- Date: 2025-11-10T18:19:07Z
- Network: telegram
- Published URL: (https://t.me/FIAgoverment/3029)
- Screenshots:
- Threat Actors: Farebi inteliigence agency
- Victim Country: India
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
24. McIver Engineering & Controls falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data.
- Date: 2025-11-10T17:02:46Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=45d3aadf-1dca-3dfb-8010-0bf99532b410)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: USA
- Victim Industry: Electrical & Electronic Manufacturing
- Victim Organization: mciver engineering & controls
- Victim Site: mcivereng.com
25. OMS a.s. falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data.
- Date: 2025-11-10T16:54:19Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=3f9c6161-359b-3f97-bf5a-6246f3920523)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: Slovakia
- Victim Industry: Electrical & Electronic Manufacturing
- Victim Organization: oms a.s.
- Victim Site: oms.lighting
26. Z-BL4CX-H4T targets the website of Agua Viva Web Radio
- Category: Defacement
- Content: Group claims to have defaced the website of Agua Viva Web Radio.
- Date: 2025-11-10T16:47:51Z
- Network: telegram
- Published URL: (https://t.me/c/3027611821/138)
- Screenshots:
- Threat Actors: Z-BL4CX-H4T
- Victim Country: Brazil
- Victim Industry: Broadcast Media
- Victim Organization: agua viva web radio
- Victim Site: aguavivacn.com
27. BABAYO EROR SYSTEM targets the website of XRET
- Category: Defacement
- Content: Group claims to have defaced the website of XRET.
- Date: 2025-11-10T16:21:55Z
- Network: telegram
- Published URL: (https://t.me/babayoerorsysteam3/644)
- Screenshots:
- Threat Actors: BABAYO EROR SYSTEM
- Victim Country: Iran
- Victim Industry: Health & Fitness
- Victim Organization: xret
- Victim Site: xret.ir
28. AMI Bearings, Inc. falls victim to Akira ransomware
- Category: Ransomware
- Content: The group claims to have obtained 15 GB of the organization’s data. The compromised data includes employee information, clients information, lots of projects information, agreements and contracts, NDAs, etc.
- Date: 2025-11-10T15:39:33Z
- Network: tor
- Published URL: (https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/)
- Screenshots:
- Threat Actors: akira
- Victim Country: USA
- Victim Industry: Machinery Manufacturing
- Victim Organization: ami bearings, inc.
- Victim Site: amibearings.com
29. Alleged sale of El Corte Inglés database
- Category: Data Breach
- Content: The threat actor claims to be selling the database of El Corte Inglés.
- Date: 2025-11-10T15:20:29Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/elcorteingles-db-avilable-on-priva1e-channe1-to-b0y-acces-dm-telgram.45652/)
- Screenshots:
- Threat Actors: jdudjbdd
- Victim Country: Spain
- Victim Industry: E-commerce & Online Stores
- Victim Organization: el corte inglés
- Victim Site: elcorteingles.es
30. Marck Industries, Inc falls victim to RansomHouse Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data.
- Date: 2025-11-10T15:17:04Z
- Network: tor
- Published URL: (http://zohlm7ahjwegcedoz7lrdrti7bvpofymcayotp744qhx6gjmxbuo2yid.onion/r/0f7ddd9fc8d180ff5fa6be3e3a4c90be530c7e19)
- Screenshots:
- Threat Actors: RansomHouse
- Victim Country: USA
- Victim Industry: Facilities Services
- Victim Organization: marck industries, inc
- Victim Site: marck.net
31. Alleged data breach of Empleos.clarin.com
- Category: Data Breach
- Content: Threat actor claims to be selling 1.65GB of data from Empleos.clarin.com. The compromised data reportedly includes personal information, contact details, experience, etc.
- Date: 2025-11-10T15:12:13Z
- Network: tor
- Published URL: (http://6czlbd2jfiy6765fbnbnzuwuqocg57ebvp3tbm35kib425k4qnmiiiqd.onion/database.html)
- Screenshots:
- Threat Actors: Kazu
- Victim Country: Argentina
- Victim Industry: Human Resources
- Victim Organization: empleos.clarin.com
- Victim Site: empleos.clarin.com
32. Z-BL4CX-H4T targets the website of SMR Electronics
- Category: Defacement
- Content: Group claims to have defaced the website of SMR Electronics.
- Date: 2025-11-10T14:48:40Z
- Network: telegram
- Published URL: (https://t.me/c/3027611821/137)
- Screenshots:
- Threat Actors: Z-BL4CX-H4T
- Victim Country: India
- Victim Industry: Consumer Electronics
- Victim Organization: smr electronics
- Victim Site: smrelectronics.com
33. Alleged data breach of Zolota Skrynia
- Category: Data Breach
- Content: The group claims to have leaked more than 210,000 records of Zolota Skrynia in Ukraine. The compromised data reportedly contain names, contact information), email addresses, phone numbers, passwords, IP addresses and user device data and password hashes of the admin panel.
- Date: 2025-11-10T14:33:23Z
- Network: telegram
- Published URL: (https://t.me/itarmy_ru/221)
- Screenshots:
- Threat Actors: IT ARMY OF RUSSIA
- Victim Country: Ukraine
- Victim Industry: Financial Services
- Victim Organization: zolota skrynia
- Victim Site: zslombard.com.ua
34. Alleged sale of AV Killer
- Category: Malware
- Content: The threat actor claims to be selling an AV Killer tool, allegedly capable of antivirus software.
- Date: 2025-11-10T14:16:55Z
- Network: openweb
- Published URL: (https://xss.pro/threads/144201/)
- Screenshots:
- Threat Actors: Detools
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
35. HEZI RASH targets the website of Sweet Beats
- Category: Defacement
- Content: The group claims to have defaced the website of Sweet Beats.
- Date: 2025-11-10T14:06:35Z
- Network: telegram
- Published URL: (https://t.me/c/3058168654/269)
- Screenshots:
- Threat Actors: HEZI RASH
- Victim Country: Australia
- Victim Industry: Hospital & Health Care
- Victim Organization: sweet beats
- Victim Site: sweetbeats.com.au
36. BMG Of Kansas, Inc. falls victim to Qilin Ransomware
- Category: Ransomware
- Content: The group claims to have obtained organization’s data.
- Date: 2025-11-10T13:27:41Z
- Network: tor
- Published URL: (http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=3e94a7a7-906d-3ba4-bfa3-69510a7e2df1)
- Screenshots:
- Threat Actors: Qilin
- Victim Country: USA
- Victim Industry: Machinery Manufacturing
- Victim Organization: bmg of kansas, inc.
- Victim Site: bmgks.com
37. Z-BL4CX-H4T targets the website of Toys Habibi
- Category: Defacement
- Content: The group claims to have defaced the website of Toys Habibi.
- Date: 2025-11-10T13:07:16Z
- Network: telegram
- Published URL: (https://t.me/c/3027611821/136)
- Screenshots:
- Threat Actors: Z-BL4CX-H4T
- Victim Country: UAE
- Victim Industry: E-commerce & Online Stores
- Victim Organization: toys habibi
- Victim Site: toyshabibi.com
38. Alleged data breach of University of Toronto
- Category: Initial Access
- Content: The threat actor claims to have gained unauthorized access to the University of Toronto’s internal systems, compromising tools such as VPN admin, IP setup, SSH, and OpenSSL.
- Date: 2025-11-10T12:45:19Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Source-Code-University-of-Toronto-Data-Breach-Leaked-Download)
- Screenshots:
- Threat Actors: KaruHunters
- Victim Country: Canada
- Victim Industry: Education
- Victim Organization: university of toronto
- Victim Site: utoronto.ca
39. Weintraub, Traub, Tracy & Virk CPAs falls victim to INC RANSOM Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization data.
- Date: 2025-11-10T12:39:29Z
- Network: tor
- Published URL: (http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures/690d02aee1a4e4b3ff38e0f8)
- Screenshots:
- Threat Actors: INC RANSOM
- Victim Country: USA
- Victim Industry: Accounting
- Victim Organization: weintraub, traub, tracy & virk cpas
- Victim Site: tax1040.com
40. Alleged leak of login access to My SEO Directory
- Category: Initial Access
- Content: The group claims to have leaked login access to My SEO Directory
- Date: 2025-11-10T12:14:37Z
- Network: telegram
- Published URL: (https://t.me/c/2326263047/531)
- Screenshots:
- Threat Actors: LEAKS DATABASE CYBER TEAM INDONESIA
- Victim Country: Unknown
- Victim Industry: Information Technology (IT) Services
- Victim Organization: my seo directory
- Victim Site: myseodirectory.com
41. Alleged access to unidentified street surveillance cameras in Israel
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to several street surveillance cameras in Israel.
- Date: 2025-11-10T11:50:51Z
- Network: telegram
- Published URL: (https://t.me/c/3058168654/263)
- Screenshots:
- Threat Actors: HEZI RASH
- Victim Country: Israel
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
42. Alleged access to unidentified surveillance cameras in Turkey
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to several surveillance cameras in Turkey.
- Date: 2025-11-10T11:46:56Z
- Network: telegram
- Published URL: (https://t.me/c/3058168654/264)
- Screenshots:
- Threat Actors: HEZI RASH
- Victim Country: Turkey
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
43. Alleged sale of French B2C data
- Category: Data Breach
- Content: The threat actor claims to be selling a database allegedly containing 30 million French B2C records sourced from Zecible.
- Date: 2025-11-10T11:41:46Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-France-French-B2C-Data-30M)
- Screenshots:
- Threat Actors: kamstudio
- Victim Country: France
- Victim Industry: Marketing, Advertising & Sales
- Victim Organization: zecible
- Victim Site: zecible.fr
44. Alleged leak of login access to Addonbiz
- Category: Initial Access
- Content: The group claims to have leaked login access to Addonbiz.
- Date: 2025-11-10T11:41:13Z
- Network: telegram
- Published URL: (https://t.me/c/2326263047/530)
- Screenshots:
- Threat Actors: LEAKS DATABASE CYBER TEAM INDONESIA
- Victim Country: India
- Victim Industry: Business and Economic Development
- Victim Organization: addonbiz
- Victim Site: addonbiz.com
45. Alleged sale of Chinese surveillance data
- Category: Data Breach
- Content: The threat actor claims to be selling a database allegedly containing Chinese surveillance data, including 3.9 million device client records and 2.7 million device user records.
- Date: 2025-11-10T11:18:33Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Chinese-Surveillance-Data)
- Screenshots:
- Threat Actors: Evisceration
- Victim Country: China
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
46. Alleged data leak of Prexel
- Category: Data Breach
- Content: The threat actor claims to have leaked user data from Prexel, allegedly containing applicant name, primary email, phone, designation, experience, city, state, zip, skills, added by, and raw resume.
- Date: 2025-11-10T11:14:53Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-prexel-win-DB)
- Screenshots:
- Threat Actors: Evisceration
- Victim Country: USA
- Victim Industry: Information Technology (IT) Services
- Victim Organization: prexel
- Victim Site: prexel.win
47. Alleged data leak of multiple websites
- Category: Data Breach
- Content: The threat actor claims to be selling databases allegedly containing user information from SEI Club and bet365, including sensitive data related to Korean users of both platforms.
- Date: 2025-11-10T11:10:00Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-SEI-Club-Dating-Bet365-Korea)
- Screenshots:
- Threat Actors: Evisceration
- Victim Country: USA
- Victim Industry: Luxury Goods & Jewelry
- Victim Organization: sei club
- Victim Site: seiclub.com
48. Alleged data sale of Dubai investors
- Category: Data Breach
- Content: The threat actor claims to be selling a database allegedly containing 648,000 lines of investor data from Dubai, including 4.6 million email addresses and 680,000 phone numbers.
- Date: 2025-11-10T10:57:14Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Dubai-Investors-DB)
- Screenshots:
- Threat Actors: Evisceration
- Victim Country: UAE
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
49. Alleged sale of unauthorized eSIM profiles from NTC
- Category: Data Breach
- Content: The group claims to be selling unauthorized eSIM profiles allegedly extracted from NTC
- Date: 2025-11-10T10:39:28Z
- Network: telegram
- Published URL: (https://t.me/ctrl_nepal/199)
- Screenshots:
- Threat Actors: GenZRisingNepal
- Victim Country: Nepal
- Victim Industry: Network & Telecommunications
- Victim Organization: Unknown
- Victim Site: Unknown
50. BABAYO EROR SYSTEM targets multiple Bangladesh websites
- Category: Defacement
- Content: The group claims to have defaced multiple Bangladesh websites.
- Date: 2025-11-10T10:37:21Z
- Network: telegram
- Published URL: (https://t.me/babayoerorsysteam3/629)
- Screenshots:
- Threat Actors: BABAYO EROR SYSTEM
- Victim Country: Bangladesh
- Victim Industry: Education
- Victim Organization: aftab bidyaniketon
- Victim Site: aftabedu.com
51. SERVER KILLERS claims to target Denmark
- Category: Alert
- Content: A recent post by the group indicates that they are targeting Denmark
- Date: 2025-11-10T10:08:38Z
- Network: telegram
- Published URL: (https://t.me/xServerKillers/200)
- Screenshots:
- Threat Actors: SERVER KILLERS
- Victim Country: Denmark
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
52. Alleged data sale of Cigarrlagret
- Category: Data Breach
- Content: The threat actor claims to be selling 160,000 lines of data from Cigarrlagret, allegedly containing id, gender, firstname, lastname, personnummer, email address, and more.
- Date: 2025-11-10T09:23:24Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Database-Sweden-cigarrlagret-nu-160K)
- Screenshots:
- Threat Actors: Robert2025
- Victim Country: Sweden
- Victim Industry: Retail Industry
- Victim Organization: cigarrlagret
- Victim Site: cigarrlagret.nu
53. Alleged data leak of Ahmadu Bello University Distance Learning Centre
- Category: Data Breach
- Content: The threat actor claims to have leaked four SQL databases from Ahmadu Bello University Distance Learning Centre, allegedly containing id, username, first_name, middle_name, last_name, email, password, and more.
- Date: 2025-11-10T09:11:59Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-abudlc-edu-ng-Download-Free-4SQL-Available)
- Screenshots:
- Threat Actors: wizard
- Victim Country: Nigeria
- Victim Industry: Education
- Victim Organization: ahmadu bello university distance learning centre
- Victim Site: abudlc-edu.ng
54. Alleged data breach of Spoleta Construction
- Category: Data Breach
- Content: The group claims to have leaked 37 GB of compressed files from Spoleta Construction. NB: The authenticity of the claim is yet to be verified.
- Date: 2025-11-10T07:56:34Z
- Network: tor
- Published URL: (http://brohoodyaifh2ptccph5zfljyajjabwjjo4lg6gfp4xb6ynw5w7ml6id.onion/)
- Screenshots:
- Threat Actors: BROTHERHOOD
- Victim Country: USA
- Victim Industry: Building and construction
- Victim Organization: spoleta construction
- Victim Site: spoleta.com
55. NoName targets the website of Odense Municipality
- Category: Ransomware
- Content: Proof of downtime : https://check-host.net/check-report/3206e8d2ke3a
- Date: 2025-11-10T07:38:35Z
- Network: telegram
- Published URL: (https://t.me/c/2787466017/279)
- Screenshots:
- Threat Actors: NoName057(16)
- Victim Country: Denmark
- Victim Industry: Civic & Social Organization
- Victim Organization: odense municipality
- Victim Site: odense.dk
56. Alleged leak of admin access to London Academy of Professional Training
- Category: Initial Access
- Content: The threat actor claims to have gained unauthorized admin access to London Academy of Professional Training.
- Date: 2025-11-10T07:36:21Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Website-access-verification-lapt-uk-United-Kingdom)
- Screenshots:
- Threat Actors: blackhunter1
- Victim Country: UK
- Victim Industry: Education
- Victim Organization: london academy of professional training
- Victim Site: verification.lapt.uk
57. Alleged leak of admin access to an unidentified organization in the Philippines
- Category: Initial Access
- Content: The threat actor claims to have gained unauthorized admin access to an unidentified organization in the Philippines.
- Date: 2025-11-10T07:31:41Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-snapmart-ph-website-admin-access-in-the-Philippines)
- Screenshots:
- Threat Actors: blackhunter1
- Victim Country: Philippines
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: snapmart.ph
58. Alleged data leak of Army officers in Bangladesh
- Category: Data Breach
- Content: The group claims to have selling more than 900 data base of retired army officers in Bangladesh.
- Date: 2025-11-10T07:14:28Z
- Network: telegram
- Published URL: (https://t.me/c/2362414795/17980)
- Screenshots:
- Threat Actors: The Night Hunters
- Victim Country: Bangladesh
- Victim Industry: Military Industry
- Victim Organization: Unknown
- Victim Site: Unknown
59. GARUDA CYBER TEAM targets the website Madrasah Aliyah Negeri (State Islamic Senior High School) in indonesia
- Category: Defacement
- Content: The group claims to have defaces the website of Madrasah Aliyah Negeri (State Islamic Senior High School) in indonesia
- Date: 2025-11-10T06:25:06Z
- Network: telegram
- Published URL: (https://t.me/c/2922666876/954)
- Screenshots:
- Threat Actors: GARUDA CYBER TEAM
- Victim Country: Indonesia
- Victim Industry: Education
- Victim Organization: madrasah aliyah negeri (state islamic senior high school)
- Victim Site: ekskul.manberau-isthebest.sch.id
60. HellR00ters Team targets multiple websites
- Category: Defacement
- Content: The group claims to have defaces multiple domains. Domains:- https://aalbertsteels.com/indexd.php https://aesind.co.in/indexd.php https://akmlights.com/indexd.php https://alamelu.in/indexd.php https://albertengineering.in/indexd.php https://anusharajesh.com/indexd.php https://bestengineerssalem.com/indexd.php https://bifi.co.in/indexd.php https://biotecresearchcentre.com/indexd.php https://bitternpharmaceuticals.com/indexd.php https://classicwaterproofingsystems.com/indexd.php https://cresha.org/indexd.php https://d6architects.in/indexd.php https://dharanhomes.com/indexd.php https://dietnamakkal.com/indexd.php https://dietsalem.com/indexd.php https://distinguishedme.co/indexd.php https://eniyahomecare.com/indexd.php https://ghosamrakshanatrust.org/indexd.php https://girivalampoojaproducts.com/indexd.php https://goldharvestea.com/indexd.php https://goldloansalem.com/indexd.php https://hotelwindsorcastlesalem.com/indexd.php https://hrhubrecruitmentagency.com/indexd.php https://ifsefiresafetyequip.com/indexd.php https://innerwheelclubofsalemmidtown.com/indexd.php https://iqtsindia.com/indexd.php https://iwaladieshostelandoldagehome.com/indexd.php https://jewelre.in/indexd.php https://kgfassociates.in/indexd.php https://licvms.com/indexd.php https://livewiresalem.com/indexd.php https://manojgoldpalace.com/indexd.php https://mettalasteels.com/indexd.php https://moneyminibankers.in/indexd.php https://mothersortho.com/indexd.php https://mydecohome.in/indexd.php https://naanayam.co.in/indexd.php https://naanayan.com/indexd.php https://oasisfamilysalon.com/indexd.php https://prithwinindustrialsupply.com/indexd.php https://psaholyangelssalem.com/indexd.php https://rajatradingcompany.com/indexd.php https://rarestones.org/indexd.php https://rashmiconsultancy.com/indexd.php https://realstoneconstruction.com/indexd.php https://rishinethralaya.org/indexd.php https://sceatn.org/indexd.php https://scriby.in/indexd.php https://sktindia.com/indexd.php https://spofitacademy.com/indexd.php https://srisornalayanattiyappalli.com/indexd.php https://srpillaimar.in/indexd.php https://sthitiyoga.in/indexd.php https://studiobyshamanails.com/indexd.php https://submarinerestaurant.com/indexd.php https://surryapropertymanagement.com/indexd.php https://suvaigal.com/indexd.php https://talkingspaces.co.in/indexd.php https://teakfurnishings.in/indexd.php https://techram.co.in/indexd.php https://tejhastex.com/indexd.php https://thegoldeneaglegroup.org/indexd.php https://themodernacademycbse.com/indexd.php https://tmseyehospitalappointment.in/indexd.php https://veekrya.art/indexd.php https://velagrovet.com/indexd.php https://vinoladental.com/indexd.php https://vivanarts.com/indexd.php https://vividinfomedia.com/indexd.php https://vizhiacademy.com/indexd.php https://windsorapartmentssalem.com/indexd.php https://winpowersystems.in/indexd.php
- Date: 2025-11-10T05:21:23Z
- Network: telegram
- Published URL: (https://t.me/c/2758066065/255)
- Screenshots:
- Threat Actors: HellR00ters Team
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
61. Alleged data breach of RESANA platform of Interministerial Directorate of Digital Affairs (DINUM)
- Category: Data Breach
- Content: The threat actor claims to be selling a database allegedly exfiltrated from RESANA, a secure collaboration platform operated by France’s Interministerial Directorate of Digital Affairs (DINUM). The compromised dataset reportedly includes email addresses, full names, personal and work phone numbers, organizational affiliations, publication metadata, recommendation records, user status, and timestamps.
- Date: 2025-11-10T04:44:51Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/resana-numerique-gouv-fr-breach-data-hawksec.45626/)
- Screenshots:
- Threat Actors: intelx
- Victim Country: France
- Victim Industry: Government Administration
- Victim Organization: interministerial directorate of digital affairs (dinum)
- Victim Site: resana.numerique.gouv.fr
62. Alleged unauthorized Shell Access to multiple domains
- Category: Initial Access
- Content: The group claims to have gained unauthorized Shell access to multiple domains. Domains:- https://kayjayforgingsmail.com/about/function.php https://indeedtraining.com/admin.php https://bsimuhendislik.com/about.php https://moranpallets.com/dropdown.php https://moreson.org/wp-admin/wp.php https://kikarchitekci.prohost.pl/about.php https://kubansmu.org/admin.php http://gaiser.org/file.php [suspicious link removed] https://icte-dubai.com/new.php https://indigoafrica.net/user.php https://sihate.co/about/function.php https://irandayun.com/dropdown.php https://www.shribhimashankarbed.com/new.php https://msk.rps-dozor.ru/about.php https://proluxingenieros.com/about.php https://surfdaweb.com/admin.php https://portraits.ecpm.org/wp-class.php https://sweetbeats.com.au/admin.php https://www.habutechnology.com/dropdown.php https://www.hoeft-immobilien.com/autoload_classmap.php https://testapicvm.edgestudio.in/about.php http://tejadosibiza.com/.hidden/config.php https://web76.green.colorhost.de/about.php https://westerfeld.fr/mah.php https://www.enjayartisticcreations.com/about.php [suspicious link removed] https://www.galantilife.com/admin.php https://www.qwertydesign.ru/defaults.php http://paty-e-thomas.com.br/about.php https://api.firehousepr.com/wp-includes/IXR/index.php https://anybizpro.com/SHELL.php https://chariseabigail.com/.hidden/config.php https://ctciwiring.com/wp-content/themes/pridmag/db.php?u https://burnwebsandbox.wpengine.com/wp-content/plugins/fix/up.php [suspicious link removed] http://baumgartlgbr.de/ws.php
- Date: 2025-11-10T04:31:33Z
- Network: telegram
- Published URL: (https://t.me/neffex_the_blackhat/18)
- Screenshots:
- Threat Actors: Neffex THe BlackHat
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
63. Alleged leak of FBI director personal data
- Category: Data Breach
- Content: Threat actor claims to have leaked FBI director personal data. The compromised data include SSN, address, etc.
- Date: 2025-11-10T03:41:57Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-%F0%9F%A4%94-KASH-PATEL-FBI-DIRECTOR-FULL-PERSONAL-DATA-LEAK-SSN-ADDRESS-%F0%9F%A4%94)
- Screenshots:
- Threat Actors: jrintel
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
64. Alleged unauthorized access to Central Bank of India
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to Central Bank of India
- Date: 2025-11-10T03:37:29Z
- Network: telegram
- Published URL: (https://t.me/tbcnofficial/170)
- Screenshots:
- Threat Actors: TEAM BD CYBER NINJA OFFICIAL
- Victim Country: India
- Victim Industry: Banking & Mortgage
- Victim Organization: central bank of india
- Victim Site: centralbank.bank.in
65. Alleged sale of Indonesian administrator court access
- Category: Data Breach
- Content: Threat actor claims to be selling Indonesian administrator court access.
- Date: 2025-11-10T01:46:53Z
- Network: openweb
- Published URL: (https://leakbase.la/threads/indonesian-administrator-court-full-acces-avilable-with-proof.45621/)
- Screenshots:
- Threat Actors: nsjzjdjd
- Victim Country: Indonesia
- Victim Industry: Judiciary
- Victim Organization: Unknown
- Victim Site: Unknown
66. TEAM BD CYBER NINJA OFFICIAL claims to target The Times of India
- Category: Alert
- Content: A recent post by the group indicates that they are targeting The Times of India.
- Date: 2025-11-10T01:19:49Z
- Network: telegram
- Published URL: (https://t.me/tbcnofficial/169)
- Screenshots:
- Threat Actors: TEAM BD CYBER NINJA OFFICIAL
- Victim Country: India
- Victim Industry: Newspapers & Journalism
- Victim Organization: the times of india
- Victim Site: timesofindia.indiatimes.com
67. CapitalPlus Exchange (CapPlus) falls victim to Sinobi Ransomware
- Category: Ransomware
- Content: The group claims to have obtained 260 GB of the organization’s data, including contracts, customer information, financial records, and other confidential assets. They intend to publish the data within 8 days.
- Date: 2025-11-10T00:56:26Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/6910f47688b6823fa25dd142)
- Screenshots:
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Financial Services
- Victim Organization: capitalplus exchange (capplus)
- Victim Site: capplus.org
68. Seward County, Kansas falls victim to Sinobi Ransomware
- Category: Ransomware
- Content: The group claims to have obtained the organization’s data, including financial records and intends to publish it within 10 days
- Date: 2025-11-10T00:17:59Z
- Network: tor
- Published URL: (http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks/6910f38388b6823fa25dca87)
- Screenshots:
- Threat Actors: Sinobi
- Victim Country: USA
- Victim Industry: Government Administration
- Victim Organization: seward county, kansas
- Victim Site: sewardcountyks.org
Conclusion
The incidents detailed in this report, spanning November 10, 2025, highlight a diverse and active landscape of cyber threats. Ransomware remains a significant threat, with groups like Everest, INC RANSOM, PLAY, Qilin, Akira, RansomHouse, and Sinobi targeting sectors including Manufacturing, Financial Services, Education, and Construction across multiple countries, notably the USA. Data breaches and data leaks are also prominent, affecting sectors such as E-commerce, Financial Services, Government, and Telecommunications in countries like Germany, France, China, India, and the UAE. Furthermore, threats involving Initial Access sales and Defacement attacks underscore the continuous need for robust security measures across various industries globally.