This report details a series of recent cyber incidents, providing key information for each event, including published URLs and associated screenshots, strictly based on the provided data.
- Alleged defacement of Lang Suan Vocational College
- Category: Defacement
- Content: The group claims to have defaced the website of Lang Suan Vocational College.
- Date: 2025-09-03T13:59:19Z
- Network: telegram
- Published URL: (https://t.me/kxichixxsec/885)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/4dd5223e-97a6-4943-8f55-9ae1a6cf7ee3.JPG
- Threat Actors: Kxichixxsec
- Victim Country: Thailand
- Victim Industry: Education
- Victim Organization: lang suan vocational college
- Victim Site: langsuan.ac.th
- Alleged data leak of an unidentified university in India
- Category: Data Breach
- Content: The threat actor claims to have leaked the database of an unidentified university in India.
- Date: 2025-09-03T13:54:37Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-DATABASE-UNIV-UDAYANA-INDIA)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/587f1caa-a2a9-4f4f-b527-27efbb535825.png
- Threat Actors: whoiam19
- Victim Country: India
- Victim Industry: Education
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged data breach of Pibulsongkram Rajabhat University
- Category: Data Breach
- Content: The group claims to have leaked the data from Pibulsongkram Rajabhat University.
- Date: 2025-09-03T13:38:25Z
- Network: telegram
- Published URL: (https://t.me/kxichixxsec/883)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/48f43a62-b74c-4a1c-99ec-9924f915996d.JPG https://d34iuop8pidsy8.cloudfront.net/fd1286f6-c30f-4368-bee3-5d602acc8ddb.JPG
- Threat Actors: Kxichixxsec
- Victim Country: Thailand
- Victim Industry: Education
- Victim Organization: pibulsongkram rajabhat university
- Victim Site: psru.ac.th
- Alleged data sale of the Department of Pensions
- Category: Data Breach
- Content: The threat actor claims to be selling over 15 GB of data from the Department of Pensions, allegedly containing information from the PMO Office, President’s Office, Police, Army, Embassy, and other government entities.
- Date: 2025-09-03T13:34:48Z
- Network: openweb
- Published URL: https://forum.exploit.in/topic/265509/
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/c3bc5d8a-8310-4f05-af8c-5789c5dfa5a4.png https://d34iuop8pidsy8.cloudfront.net/7ee1370b-9720-4926-bf9c-6f499eb8281f.png https://d34iuop8pidsy8.cloudfront.net/283d90d1-c0fe-4776-9654-a3053424b3c2.png https://d34iuop8pidsy8.cloudfront.net/ecdb26a0-d431-4db2-846e-3f21e638d4e9.png
- Threat Actors: xuii
- Victim Country: Sri Lanka
- Victim Industry: Government Administration
- Victim Organization: department of pensions
- Victim Site: pensions.gov.lk
- Alleged Sale of 237K Corporate MailPass Combo List
- Category: Combo List
- Content: The threat actor claims to be selling a database containing 237,000 corporate email and password combinations.
- Date: 2025-09-03T13:28:06Z
- Network: openweb
- Published URL: https://forum.exploit.in/topic/265511/
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/e59fe1e0-a2d3-4f59-9623-2e39f13852d0.png
- Threat Actors: Domainstore
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged leak of admin access to the Regional Directorate of Transport and Communications of La Libertad
- Category: Initial Access
- Content: Group claims to have leaked administrative credentials to the Regional Directorate of Transport and Communications of La Libertad
- Date: 2025-09-03T13:14:36Z
- Network: telegram
- Published URL: (https://t.me/DefacePeru/1464)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/0e29f8e6-911c-4739-9d0e-ece1d69dfaf3.png
- Threat Actors: Deface Peru
- Victim Country: Peru
- Victim Industry: Transportation & Logistics
- Victim Organization: regional directorate of transport and communications of la libertad
- Victim Site: grtclalibertad.gob.pe
- Alleged data sale of GoPulse
- Category: Data Breach
- Content: The threat actor claims to be selling a database of GoPulse, containing approximately 382 million user records. The dataset reportedly includes extensive user information such as usernames, full names, email addresses, phone numbers, IP addresses, support PINs, signup dates, account and balance details, organization names, physical addresses, and login history.
- Date: 2025-09-03T13:07:45Z
- Network: telegram
- Published URL: (https://t.me/digitalsghost/855)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/99d6a161-df00-4745-bdd0-3a63d2281535.png https://d34iuop8pidsy8.cloudfront.net/cc82dfb6-cfc0-4606-af0c-40e0ce354eb7.png
- Threat Actors: DigitalGhost
- Victim Country: Iceland
- Victim Industry: Financial Services
- Victim Organization: gopulse
- Victim Site: gopulse.com
- Alleged defacement of Diskal Group
- Category: Defacement
- Content: The group claims to have defaced the website of Diskal Group
- Date: 2025-09-03T12:31:40Z
- Network: telegram
- Published URL: (https://t.me/sarbazan_nur/628)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/b63417d3-35ad-49f6-9c4b-37c5c787c459.JPG
- Threat Actors: Sarbazan Nur
- Victim Country: Israel
- Victim Industry: Information Technology (IT) Services
- Victim Organization: diskal group
- Victim Site: diskal.co.il
- Alleged sale of access to unidentified U.S.-based law firm
- Category: Initial Access
- Content: The threat actor claims to be selling VPN access to an unidentified U.S.-based law firm, including domain user privileges.
- Date: 2025-09-03T11:53:09Z
- Network: openweb
- Published URL: https://forum.exploit.in/topic/265506/
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/d89689e0-f033-47b0-a9e9-b055cef5c073.png
- Threat Actors: internetbandit
- Victim Country: USA
- Victim Industry: Law Practice & Law Firms
- Victim Organization: Unknown
- Victim Site: Unknown
- Meduza Cyber Force claims to target Ministry of Education, Research, Youth and Sports of Romania
- Category: Alert
- Content: A recent post by the group indicates that they are targeting Ministry of Education, Research, Youth and Sports of Romania
- Date: 2025-09-03T11:37:36Z
- Network: telegram
- Published URL: (https://t.me/MeduzaCyberForce/95)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/37d5d9a4-6da2-4fc7-9eef-e210c10d3215.png
- Threat Actors: Meduza Cyber Force
- Victim Country: Romania
- Victim Industry: Government Administration
- Victim Organization: ministry of education, research, youth and sports
- Victim Site: jobs.edu.ro
- Meduza Cyber Force claims to target Ministry of Education, Romania
- Category: Alert
- Content: A recent post by the group indicates that they are targeting Ministry of Education, Romania
- Date: 2025-09-03T11:32:07Z
- Network: telegram
- Published URL: (https://t.me/MeduzaCyberForce/95)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/37d5d9a4-6da2-4fc7-9eef-e210c10d3215.png
- Threat Actors: Meduza Cyber Force
- Victim Country: Romania
- Victim Industry: Government Administration
- Victim Organization: ministry of education
- Victim Site: jobs.edu.ro
- Alleged data leak of unidentified organisation in Thailand
- Category: Data Breach
- Content: The group claims to have leaked the data from unidentified organisation in Thailand.
- Date: 2025-09-03T11:19:12Z
- Network: telegram
- Published URL: (https://t.me/kxichixxsec/879)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/79fc0b26-b3e3-4e10-af11-f31a958fbdf6.JPG
- Threat Actors: Kxichixxsec
- Victim Country: Thailand
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged data leak of unidentified organisation in Thailand
- Category: Data Breach
- Content: The group claims to have leaked the data from unidentified organisation in Thailand.
- Date: 2025-09-03T10:43:32Z
- Network: telegram
- Published URL: (https://t.me/kxichixxsec/876)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/59e6395a-80f1-4557-aaff-5385e0f03eb7.JPG
- Threat Actors: Kxichixxsec
- Victim Country: Thailand
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged Sale of Data and System Access from Pakistan Embassy in Turkey
- Category: Data Breach
- Content: The threat actor claims to be selling 4.5 GB of data from the Pakistan Embassy in Istanbul, Turkey and allegedly offering system access, browser passwords, and VPN access. The VPN access is said to allow entry into NADRA HQ systems in Pakistan for internal documents.
- Date: 2025-09-03T10:20:21Z
- Network: openweb
- Published URL: https://forum.exploit.in/topic/265497/
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/93b22888-e84a-40b1-b9b7-3a2e9a14ed18.png
- Threat Actors: xuii
- Victim Country: Pakistan
- Victim Industry: Government Administration
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged data leak of unidentified organization in Thailand
- Category: Data Breach
- Content: The group claims to have leaked the database from an unidentified organization in Thailand
- Date: 2025-09-03T09:58:16Z
- Network: telegram
- Published URL: (https://t.me/kxichixxsec/868)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/014aa6a5-52a0-4945-acd2-1bae5ec60c30.png https://d34iuop8pidsy8.cloudfront.net/d893fb29-093c-41b3-ba71-f612cc30d5b6.png
- Threat Actors: Kxichixxsec
- Victim Country: Thailand
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged unauthorized access to refrigeration control system in Ukraine
- Category: Initial Access
- Content: The group claims to have gained full access to the control network of a refrigeration chamber system at a facility in Ukraine, allegedly enabling them to view and adjust temperature controllers, defrost settings, and monitor alarm states in real time. The reported compromise included oversight of compressor stations and safety indicators, along with the ability to log and alter sensor readings.
- Date: 2025-09-03T09:41:51Z
- Network: telegram
- Published URL: (https://t.me/Z_ALLIANCE/696)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/1be8986c-9d71-459c-8668-65b0ea34658b.png https://d34iuop8pidsy8.cloudfront.net/d6558ba9-828a-4377-933a-7049d8e4e0c4.png
- Threat Actors: Z-ALLIANCE
- Victim Country: Ukraine
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged data leak of unidentified Network system in Thailand
- Category: Data Breach
- Content: The group claims to have leaked the database from an unidentified Network system in Thailand.
- Date: 2025-09-03T09:30:34Z
- Network: telegram
- Published URL: (https://t.me/ntsec4real/60?single)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/89854c1e-d7a4-41b4-8059-25f207e8e2a3.JPG https://d34iuop8pidsy8.cloudfront.net/255eabc0-6d62-4dc0-b61b-ce22ca95396f.JPG
- Threat Actors: NTSEC
- Victim Country: Thailand
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged unauthorized access to unidentified microclimate in poultry houses system in Italy
- Category: Initial Access
- Content: The group claims to have gained unauthorized access to an unidentified microclimate in poultry houses system in Italy. The compromised system allegedly supports ventilation, temperature, cooling and heating, as well as lighting, air quality, and the condition of the flock.
- Date: 2025-09-03T08:09:35Z
- Network: telegram
- Published URL: (https://t.me/n2LP_wVf79c2YzM0/1344)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/1eba88ed-502e-43a6-a88f-a6d8a4745ec0.JPG
- Threat Actors: Infrastructure Destruction Squad
- Victim Country: Italy
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged Data Leak of Ribalovers
- Category: Data Breach
- Content: The threat actor claims to have leaked a database from Ribalovers, containing users’ personal and sensitive information.
- Date: 2025-09-03T08:04:12Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Russian-FREE-DATABASE-Ribalovers-ru)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/74205d3d-edfd-4bdd-9ecc-95afff5352cc.png
- Threat Actors: Wizard
- Victim Country: Russia
- Victim Industry: Social Media & Online Social Networking
- Victim Organization: ribalovers
- Victim Site: ribalovers.ru
- Alleged data leak of Ozar
- Category: Data Breach
- Content: The threat actor claims to have leaked a database of Ozar. The data includes email addresses, passwords, full names, account status, language settings, and user IDs.
- Date: 2025-09-03T07:54:39Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-ukraine-ozar-com-ua)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/353db6f1-7e04-4f03-8e31-3bc994a0659d.png
- Threat Actors: Wizard
- Victim Country: Ukraine
- Victim Industry: E-commerce & Online Stores
- Victim Organization: ozar
- Victim Site: ozar.com.ua
- Alleged data leak of Ukrainian Association of Travel Agencies (UATA)
- Category: Data Breach
- Content: The threat actor claims to have leaked a database of Ukrainian Association of Travel Agencies (UATA). The data includes usernames, hashed passwords, email addresses, display names, and activation keys.
- Date: 2025-09-03T07:54:06Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Free-DB-uata-org-ua-Ukraine)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/d29babe9-ffe3-415f-a70b-aa0f35869663.png
- Threat Actors: Wizard
- Victim Country: Ukraine
- Victim Industry: Hospitality & Tourism
- Victim Organization: ukrainian association of travel agencies (uata)
- Victim Site: uata.org.ua
- Alleged data sale of Domcor Health Safety & Security
- Category: Data Breach
- Content: The threat actor claims to be selling a database from Domcor Health Safety & Security. The leaked content includes 11,383 files across 1,337 folders, suggesting a full directory-level compromise.
- Date: 2025-09-03T07:53:05Z
- Network: openweb
- Published URL: https://darkforums.st/Thread-Source-Code-Domcor-Health-Safety-Security
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/a468a21c-9aac-44cf-8609-08ab20d5283b.png
- Threat Actors: Purple0piOd
- Victim Country: Canada
- Victim Industry: Public Safety
- Victim Organization: domcor health safety & security
- Victim Site: domcor.ca
- Alleged data leak of GoldShield
- Category: Data Breach
- Content: The threat actor claims to have leaked a database of GoldShield. The file reportedly contains 2,175 user records and includes fields such as Agency Name, User IDs, names, login timestamps, failed login attempts, admin flags, GPS and chat permissions, email addresses, badge numbers, and contact information.
- Date: 2025-09-03T07:52:56Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Leaked-Database-US-Police-GoldShield-System-Users-Info)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/a0f72402-ce38-4a8f-a908-408714731ce8.png
- Threat Actors: hhhhhaplus
- Victim Country: USA
- Victim Industry: Law Enforcement
- Victim Organization: goldshield
- Victim Site: goldshield-usa.com
- Alleged data sale of University of Southeastern Philippines (USEP)
- Category: Data Breach
- Content: The threat actor claims to be selling a database from the University of Southeastern Philippines (USEP). The leaked data includes over 175,000 lines of data across multiple tables such as enrolled, student records, monitoring, users, transaction, and system log. The leaked content contains student personal details including ID numbers, full names, email addresses, enrollment status, file locations, and academic monitoring records.
- Date: 2025-09-03T07:52:50Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-University-of-Southeastern-Philippines-Breach)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/9ed5a3ac-62d6-4863-88dd-2f6e30d66aeb.png https://d34iuop8pidsy8.cloudfront.net/9d20b972-761b-43aa-8ac8-ed2415a8ef18.png
- Threat Actors: MAxxX
- Victim Country: Philippines
- Victim Industry: Education
- Victim Organization: university of southeastern philippines (usep)
- Victim Site: usep.edu.ph
- NTSEC targets the website of Phuket Destination Co.,Ltd.
- Category: Defacement
- Content: The group claims to have defaced the website of Phuket Destination Co.,Ltd..
- Date: 2025-09-03T07:50:33Z
- Network: telegram
- Published URL: (https://t.me/ntsec4real/59)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/963acfdd-20fb-4841-b9be-124fb6d69495.png
- Threat Actors: NTSEC
- Victim Country: Thailand
- Victim Industry: Leisure & Travel
- Victim Organization: phuket destination co.,ltd.
- Victim Site: phuketdestination.co.th
- Alleged data breach of Risen Energy
- Category: Data Breach
- Content: The group claims to have leaked data from Risen Energy.
- Date: 2025-09-03T07:25:45Z
- Network: tor
- Published URL: https://worldleaksartrjm3c6vasllvgacbi5u3mgzkluehrzhk2jz4taufuid.onion/companies/5141514357/overview
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/43c8b2e7-0d89-4fe4-90dc-d2b26b11ff54.png https://d34iuop8pidsy8.cloudfront.net/5668419b-7026-40d1-a7f6-0025012ab578.png
- Threat Actors: Worldleaks
- Victim Country: China
- Victim Industry: Manufacturing
- Victim Organization: risen energy co., ltd
- Victim Site: en.risen.com
- Alleged data sale of Indonesian Army soliders
- Category: Data Breach
- Content: The threat actor claims to be selling a 10GB database containing personal information of Indonesian Army soldiers. The dataset reportedly includes sensitive fields such as full name, address, phone number, date of birth, NIP (Nomor Induk Pegawai – Employee ID), NPWP (Tax ID Number), and other private data.
- Date: 2025-09-03T07:07:47Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Document-INDONESIAN-ARMY-DATA-HAS-BEEN-HACKED)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/9506d018-f4dc-4ffb-9761-5ac5c5fac475.png
- Threat Actors: xbrightz
- Victim Country: Indonesia
- Victim Industry: Military Industry
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged unathorized access to Department of Health – Philippines (EDPMS)
- Category: Initial Access
- Content: The threat actor claims to have gained unauthorized access to the Electronic Drug Price Monitoring System (EDPMS) managed by the Philippine Department of Health.
- Date: 2025-09-03T07:07:43Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-edpms-doh-gov-ph)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/2ff56f83-f7ef-492f-9987-401f3db0d47b.png
- Threat Actors: Sckr1ptK1ddiE
- Victim Country: Philippines
- Victim Industry: Hospital & Health Care
- Victim Organization: department of health – philippines (edpms)
- Victim Site: edpms.doh.gov.ph
- Alleged data sale of MBDA
- Category: Data Breach
- Content: The threat actor claims to be selling a 4TB MBDA NATO database and documents with free login access.
- Date: 2025-09-03T06:35:19Z
- Network: telegram
- Published URL: (https://t.me/digitalsghost/844)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/fa277e2c-db34-4ce0-b930-52ed0ebcd9b0.png https://d34iuop8pidsy8.cloudfront.net/51188d97-446b-4661-9754-ddcd09b1339f.png
- Threat Actors: DigitalGhost
- Victim Country: UK
- Victim Industry: Defense & Space
- Victim Organization: mbda
- Victim Site: mbda-systems.com
- Alleged sale of RDWeb access to an unidentified Singapore company
- Category: Initial Access
- Content: A Singapore-based RDWEB access related to an engineering services company.
- Date: 2025-09-03T05:13:01Z
- Network: openweb
- Published URL: https://forum.exploit.in/topic/265482/
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/d6780f5c-adf2-406b-8c39-8671956f42e5.png
- Threat Actors: gadji
- Victim Country: Singapore
- Victim Industry: Civil Engineering
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged data breach of Prep Hoops
- Category: Data Breach
- Content: The threat actor claims to be selling data from the Prep Hoops breach, which also affected Prep Girl Hoops, PrepDig, Prep Redzone, and BallerTV. The dataset reportedly contains information on over 430,000 unique users, including player and staff records, program details, communications, contracts, payment data, orders, tickets, and notification logs. Samples shared indicate exposure of names, emails, phone numbers, ticket purchases, event attendance, staff roles, player stats, and text campaign records.
- Date: 2025-09-03T04:31:48Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-Prep-Hoops-Data-Breach)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/8507c448-8a9b-4b34-b304-8162533bf489.png https://d34iuop8pidsy8.cloudfront.net/591a6117-a5e1-4ba7-af53-74c7af8b7723.png https://d34iuop8pidsy8.cloudfront.net/984b926c-9e7f-4fdf-b91a-7fcead4bb66d.png https://d34iuop8pidsy8.cloudfront.net/7898dd1c-a6d5-49f4-9c13-e877e79629d5.png
- Threat Actors: 888
- Victim Country: USA
- Victim Industry: Sports
- Victim Organization: prep hoops
- Victim Site: prephoops.com
- Alleged sale of 2 JP SMTPS
- Category: Data Breach
- Content: The threat actor is offering two SMTP servers for sale. The servers support TLS and have a size limit of 4.1 MB. They include capabilities such as authentication, pipelining, DSN, 8BITMIME, and SIZE. VRFY and EXPN commands are disabled, and the relay is closed.
- Date: 2025-09-03T04:14:48Z
- Network: openweb
- Published URL: https://breachsta.rs/topic/selling-2-jp-smtps-g4z970ynypko
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/46f238d4-8e8d-4d0b-8084-ad80b055dd01.png
- Threat Actors: Lucifer
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged Leak of Iranian Cloud Hosting Provider Database
- Category: Data Breach
- Content: The threat actor claims to be selling data from Iranian cloud hosting provider has allegedly been leaked, containing 1,300 personal records including names, emails, passwords, phone numbers, addresses, and tax IDs (TR, DE, AE). The breach also includes 1,200 decrypted CMS passwords, credentials for 245 servers, admin and database logins for over 1,200 CMS installations (e.g., WordPress, Joomla), 170 API tokens, 3,500 OAuth tokens for services like Google and cPanel, and backend source code with API keys and AES-encrypted configuration files.
- Date: 2025-09-03T04:13:22Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Ultimate-Iranian-Hosting-Breach-Original-Unpublished)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/25eda729-7c99-4fc5-9c21-9103d525d4f1.png
- Threat Actors: Gratinoski
- Victim Country: Iran
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged sale of 328 KYC documents from multiple countries
- Category: Data Breach
- Content: The threat actor claims to be selling a database of 328 KYC documents from mixed countries, primarily from Western Europe, along with entries from the U.S., U.K., and Asia. The dataset includes front and back images of government-issued IDs, selfies of the individuals, and in some cases, video selfies featuring a 180-degree facial scan.
- Date: 2025-09-03T03:49:45Z
- Network: openweb
- Published URL: https://breachsta.rs/topic/selling-328-kyc-documents-for-cheap-with-selfie-and-video-xae1bvcyk1a6
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/25fc2dec-98f9-469d-9797-bc0aba3302e2.png
- Threat Actors: hcuajswn
- Victim Country: Unknown
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged Data Breach of City Water Purifier
- Category: Data Breach
- Content: The threat actor claims to have leaked 30,387 rows of customer and service data from citywaterpurifie r, including personal details, service records, and billing information, with additional content accessible through forum interaction.
- Date: 2025-09-03T03:31:00Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-City-Water-Purifier-Data-Breach-Leaked-Download)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/b98f205e-655b-4788-bebb-df1f6c88f480.png https://d34iuop8pidsy8.cloudfront.net/fef1ff41-715e-47aa-a3c4-cf3dd1dc8b39.png
- Threat Actors: N1KA
- Victim Country: India
- Victim Industry: Environmental Services
- Victim Organization: city water purifier
- Victim Site: citywaterpurifier.com
- Alleged data breach of LeaseHawk
- Category: Data Breach
- Content: The threat actor claims to be selling data from a LeaseHawk, a U.S.-based company providing multifamily software and leasing solutions. The breach reportedly exposes 222,700 unique user emails along with detailed records such as event types, page visits, IP addresses, phone numbers, guest card IDs, transcripts, and email communications.
- Date: 2025-09-03T03:30:26Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-Selling-LeaseHawk-Data-Breach)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/977cb467-1056-4f57-80a1-f329406be496.png https://d34iuop8pidsy8.cloudfront.net/3cb552e5-9f35-411e-8b4f-a1258e1b43d4.png https://d34iuop8pidsy8.cloudfront.net/f43f2a61-c47a-4d77-8ad7-4cb03c97d3b9.png
- Threat Actors: 888
- Victim Country: USA
- Victim Industry: Software Development
- Victim Organization: leasehawk
- Victim Site: leasehawk.com
- Alleged sale of access to Funghi Energia & Salute Srl
- Category: Initial Access
- Content: The threat actor claims to be selling Magento access to Funghi Energia & Salute Srl. The access reportedly allows management of orders, retrieval of customer data, and other administrative functions
- Date: 2025-09-03T03:04:41Z
- Network: openweb
- Published URL: https://breachsta.rs/topic/selling-magento-access-to-funghidexanetbiz-fr3eib9kdyan
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/309ce62a-661f-4fe0-88ee-f430d7a762c5.png
- Threat Actors: Lucifer
- Victim Country: Italy
- Victim Industry: Health & Fitness
- Victim Organization: funghi energia & salute srl
- Victim Site: funghi.dexanet.biz
- Alleged data leak of 350K U.S. businesses records
- Category: Data Breach
- Content: The threat actor claims to be leaking a database of over 350K records containing email addresses and physical addresses of U.S. businesses, ranging from small to large companies. The dataset includes corporate entities such as FedEx, with domains spanning personal email services (Gmail, Yahoo) and corporate domains (e.g., hotel.com).
- Date: 2025-09-03T02:44:37Z
- Network: openweb
- Published URL: https://breachsta.rs/topic/us-businesses-leak-small-large-scale-q5lc5cgifb39
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/6f573611-d82a-434b-98cc-20ff53505099.png
- Threat Actors: hcuajswn
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged Data Leak of JPMorgan
- Category: Data Breach
- Content: Threat actor claims to leak a database of 500,000 September JPMorgan shareholder stock investment transactions in Thailand. NB : Authenticity of claim is yet to be verified
- Date: 2025-09-03T02:42:09Z
- Network: telegram
- Published URL: (https://t.me/aqj986/6926)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/94b9f552-55e8-4533-b192-9d4927f74379.png
- Threat Actors: Ai Qian Jin » Global Real-Time Data Channel
- Victim Country: Thailand
- Victim Industry: Banking & Mortgage
- Victim Organization: jpmorgan
- Victim Site: jpmorgan.com
- Alleged Data Leak of Zerodha
- Category: Data Breach
- Content: Threat actor claims to leak a database of 670,000 September India Zerodha Securities stock investors’ trading accounts. NB : Authenticity of claim is yet to be verified
- Date: 2025-09-03T02:33:02Z
- Network: telegram
- Published URL: (https://t.me/aqj986/6925)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/8721993a-aeaa-4a54-91e7-6be52fc1d4df.png
- Threat Actors: Ai Qian Jin » Global Real-Time Data Channel
- Victim Country: India
- Victim Industry: Investment Management, Hedge Fund & Private Equity
- Victim Organization: zerodha
- Victim Site: zerodha.com
- Alleged Data Leak of Porto Seguro
- Category: Data Breach
- Content: Threat actor claims to leak a database of Brazil’s Porto Seguro Group (Porto) Insurance Company, the third largest insurer in the country, affecting customers across auto, home, health, life, and commercial insurance services NB : Authenticity of claim is yet to be verified
- Date: 2025-09-03T02:18:27Z
- Network: telegram
- Published URL: (https://t.me/aqj986/6924)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/e45f1ec4-a348-45c1-8f5f-ef8aeea7bbe6.png
- Threat Actors: Ai Qian Jin » Global Real-Time Data Channel
- Victim Country: Brazil
- Victim Industry: Insurance
- Victim Organization: porto seguro
- Victim Site: portoseguro.com.br
- Alleged Data Leak of Unidentified Online Gambling Slot Thailand
- Category: Data Breach
- Content: Threat actor claims to leak a database of 490,000 September Thailand online gambling slot machine players, including account balances. NB : Authenticity of claim is yet to be verified.
- Date: 2025-09-03T02:13:45Z
- Network: telegram
- Published URL: (https://t.me/aqj986/6928)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/6bf37072-5bc5-4a2f-8df7-e1be74e7180f.png
- Threat Actors: Ai Qian Jin » Global Real-Time Data Channel
- Victim Country: Thailand
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged Data Leak of State Bank of India
- Category: Data Breach
- Content: Threat actor claims to leak a database of 590,000 September India SBI (State Bank of India) personal and business loan customers, with associated loan amounts. NB : Authenticity of claim is yet to be verified
- Date: 2025-09-03T02:07:47Z
- Network: telegram
- Published URL: (https://t.me/aqj986/6929)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/80534930-257e-45b8-814f-94861a843a39.png
- Threat Actors: Ai Qian Jin » Global Real-Time Data Channel
- Victim Country: India
- Victim Industry: Banking & Mortgage
- Victim Organization: state bank of india
- Victim Site: onlinesbi.sbi
- Alleged Data Leak of Silicon Valley Bank
- Category: Data Breach
- Content: Threat actor claims to leak a database of 560,000 September US Silicon Valley Bank large fund client cash management accounts. NB : Authenticity of claim is yet to be verified
- Date: 2025-09-03T02:01:07Z
- Network: telegram
- Published URL: (https://t.me/aqj986/6930)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/7a902501-aec0-4aa7-82e9-ab24a4decebd.png
- Threat Actors: Ai Qian Jin » Global Real-Time Data Channel
- Victim Country: USA
- Victim Industry: Banking & Mortgage
- Victim Organization: silicon valley bank
- Victim Site: svb.com
- Alleged Data Leak of LPL Private Wealth Management
- Category: Data Breach
- Content: Threat actor claims to leak a database of 800,000 September LPL Financial private wealth advisory and custody investment clients over the age of 40. NB : Authenticity of claim is yet to be verified
- Date: 2025-09-03T01:56:40Z
- Network: telegram
- Published URL: (https://t.me/aqj986/6931)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/45141178-05c7-4694-9b33-300e5b6eefe6.png
- Threat Actors: Ai Qian Jin » Global Real-Time Data Channel
- Victim Country: USA
- Victim Industry: Insurance
- Victim Organization: lpl private wealth management
- Victim Site: lpl.com
- Alleged Data Leak of Goldman Sachs Bank
- Category: Data Breach
- Content: Threat actor claims to leak a database of 760,000 September Goldman Sachs Bank Group (Goldman Sachs) investment account holders, with August fund transfers ranging from 100,000 to 500,000 USD. NB : Authenticity of claim is yet to be verified
- Date: 2025-09-03T01:48:54Z
- Network: telegram
- Published URL: (https://t.me/aqj986/6932)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/5b72c568-26ca-46d2-904b-e05609219ce8.png
- Threat Actors: Ai Qian Jin » Global Real-Time Data Channel
- Victim Country: USA
- Victim Industry: Banking & Mortgage
- Victim Organization: goldman sachs bank
- Victim Site: goldmansachs.com
- Alleged Data Leak of Banco Galicia
- Category: Data Breach
- Content: Threat actor claims to leak a database of Argentina BANCO GALICIA categorized premium accounts of september. NB : Authenticity of claim is yet to be verified
- Date: 2025-09-03T01:37:32Z
- Network: telegram
- Published URL: (https://t.me/aqj986/6934)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/ed27a9e8-6b43-4a26-a4cc-0e86ad4a8b4b.png
- Threat Actors: Ai Qian Jin » Global Real-Time Data Channel
- Victim Country: Argentina
- Victim Industry: Banking & Mortgage
- Victim Organization: banco galicia
- Victim Site: galicia.ar
- Alleged Data Leak of Unidentified bank
- Category: Data Breach
- Content: Threat actor claims to leak a database of 780,000 (male) september US Fidelity Investments annuities, IRA, wealth management accounts. NB : Authenticity of claim is yet to be verified
- Date: 2025-09-03T01:30:48Z
- Network: telegram
- Published URL: (https://t.me/aqj986/6935)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/3661ac98-2341-4e51-80b6-02319091b44f.png
- Threat Actors: Ai Qian Jin » Global Real-Time Data Channel
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged leak of USA personal data
- Category: Data Breach
- Content: Threat actor claims to have leaked millions of personal records, including name, last name, email, date of birth, and phone number, affecting individuals and companies across the USA and Europe.
- Date: 2025-09-03T00:59:50Z
- Network: openweb
- Published URL: https://leakbase.la/threads/usa-and-europe-personal-information-leak.42247/
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/1e18c3ff-82b5-45c3-a7fe-c6c85d19992a.png
- Threat Actors: Sensey22
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
- Alleged Data Breach of In22 Labs
- Category: Data Breach
- Content: Threat actor claims to share three GoFile links allegedly containing compromised data from in22labs.com: one file with emails, phone numbers, and names, another with emails and phone numbers, and a third containing information related to projects.
- Date: 2025-09-03T00:43:00Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-in22labs-com)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/c6a3ac85-d966-4d2e-a739-97a01b1a25bb.png
- Threat Actors: kanie2903
- Victim Country: India
- Victim Industry: Information Technology (IT) Services
- Victim Organization: in22 labs
- Victim Site: in22labs.com
- Alleged data breach of KashmirPort
- Category: Data Breach
- Content: The group claims to have breached KashmirPort database .
- Date: 2025-09-03T00:29:28Z
- Network: telegram
- Published URL: (https://t.me/liwaamohammad/742)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/bfe0508b-324d-4a79-88e8-25f56f8e5313.png https://d34iuop8pidsy8.cloudfront.net/e96c548e-dcc4-4ea8-afb1-cdc16cbf9b84.png
- Threat Actors: Liwaa Muhammad
- Victim Country: India
- Victim Industry: Leisure & Travel
- Victim Organization: kashmirport
- Victim Site: kashmirport.com
- Alleged Data Leak of USA Marketing Database
- Category: Data Breach
- Content: Threat actor claims to be selling a database of 1.6 million U.S. contacts ,including names, phone numbers, and email addresses.
- Date: 2025-09-03T00:04:22Z
- Network: openweb
- Published URL: (https://darkforums.st/Thread-DATABASE-Selling-1-6-Million-USA-Marketing-Database)
- Screenshots: https://d34iuop8pidsy8.cloudfront.net/906f64fb-5ed1-4df2-8a15-806a68e1a54a.png
- Threat Actors: neelki
- Victim Country: USA
- Victim Industry: Unknown
- Victim Organization: Unknown
- Victim Site: Unknown
Conclusion The incidents detailed in this report highlight a diverse and active landscape of cyber threats. Data breaches and leaks are prominent, affecting various sectors from education and leisure & travel to financial services and government administration, and impacting countries including Thailand, India, Sri Lanka, Peru, Iceland, Israel, Russia, Ukraine, Canada, Philippines, China, Indonesia, UK, Singapore, Italy, Brazil, Argentina, and USA. The compromised data ranges from personal user information and sensitive employee and customer records to administrative credentials and classified military documents.
Beyond data compromise, the report also reveals significant activity in initial access sales, with threat actors offering unauthorized access to government systems, corporate networks, and other industrial infrastructure. The sale of malware and combo lists further underscores the availability of offensive capabilities in the cyber underground.
The incidents collectively demonstrate that organizations across various industries and geographies face persistent threats from data exfiltration, unauthorized network access, and the proliferation of malicious tools. The nature of these incidents emphasizes the critical importance of robust cybersecurity measures, including strong access controls, data protection strategies, continuous vulnerability management, and proactive threat intelligence to defend against a wide array of sophisticated and opportunistic attacks.