Intel and Breaches @IBreaches

🇮🇳 Alleged ICMAI Member Dataset Advertised on Breach Forum A threat actor has posted a listing claiming to possess a dataset allegedly associated with the Institute of Cost Accountants of India (ICMAI), containing approximately 400,000 member records. According to the forum post, the exposed data allegedly includes: • Member IDs and membership details • Full names and dates of birth • Email addresses and mobile numbers • Residential address information • PAN, GST, and identity document details • Employment and professional information • Certificate of Practice (COP) status • Portal login metadata, including IP addresses and login timestamps The threat actor claims the dataset contains approximately 50 data fields related to member registration, professional records, and account metadata. At the time of reporting, the authenticity of the dataset, the source of the data, and the extent of any potential compromise remain unverified. ⚠️ These claims originate from a threat actor forum post and should be treated as unverified until independently validated. #DataBreach #ThreatIntel #CyberSecurity #DataLeak #ICMAI #India #OSINT #Infosec

🇨🇴 Alleged Bogotá Secretariat of Mobility Database Advertised on Breach Forum A threat actor has posted a listing claiming to have compromised the Secretariat of Mobility of Bogotá (Secretaría de Movilidad de Bogotá) and obtained a database containing approximately 4.6 million records. According to the forum post, the exposed data allegedly includes: • Full names and ID numbers • Phone numbers and email addresses • Driver's license information • Vehicle registration details • Traffic fines and infraction records • Vehicle photos, videos, and evidence files • SOAT and vehicle documentation The threat actor further claims the compromise was achieved through an IDOR vulnerability followed by a Broken Function Level Authorization (BFLA) issue, allegedly allowing modification and management of traffic tickets. These technical claims have not been independently verified. At the time of reporting, the authenticity of the dataset, the source of the data, and the extent of any potential compromise remain unverified. ⚠️ These claims originate from a threat actor forum post and should be treated as unverified until independently validated. #DataBreach #ThreatIntel #CyberSecurity #DataLeak #Colombia #Bogota #OSINT #Infosec

keyboard_arrow_left Previous keyboard_arrow_right Next

🇲🇦 Alleged Stellantis Morocco Database Advertised on Breach Forum A threat actor has posted a listing claiming to have compromised the Moroccan branch of Stellantis and extracted a customer database. According to the forum post, the exposed data allegedly includes: • Vehicle make and model • Customer names • Phone numbers • Email addresses • City information • Campaign records • Reseller information • Customer comments The actor shared a sample containing approximately 1,000 records and claims to possess the complete dataset. At the time of reporting, the authenticity of the dataset, the source of the data, and the extent of any potential compromise remain unverified. ⚠️ These claims originate from a threat actor forum post and should be treated as unverified until independently validated. #DataBreach #ThreatIntel #CyberSecurity #DataLeak #Stellantis #Morocco #OSINT #Infosec

🇺🇸 Alleged FlexBooker Database Advertised on Breach Forum A threat actor has posted a listing claiming to possess a database allegedly associated with FlexBooker, an online appointment scheduling and booking platform. According to the sample shared in the forum post, the exposed data allegedly includes: • First and last names • Email addresses • Phone numbers • Masked payment card information • Customer identifiers • Search/profile-related metadata The actor also shared sample records containing customer contact information and partially masked payment card details. At the time of reporting, the authenticity of the dataset, the source of the data, and the extent of any potential compromise remain unverified. ⚠️ These claims originate from a threat actor forum post and should be treated as unverified until independently validated. #DataBreach #ThreatIntel #CyberSecurity #DataLeak #FlexBooker #OSINT #Infosec #CyberThreats

🇫🇷 Alleged LBP-TM.FR Database Leak Advertised on Breach Forum A threat actor has published a database allegedly associated with LBP-TM.FR, claiming to contain 3.69 million records. According to the post, the exposed data allegedly includes: • Full names • Email addresses • Postal addresses • Postal codes and cities • Country information • Child names and birth information • Additional demographic data The actor claims the dataset originates from January 2026 and is being released publicly. At the time of reporting, the authenticity of the dataset, the source of the data, and the extent of any potential compromise remain unverified. ⚠️ These claims originate from a threat actor forum post and should be treated as unverified until independently validated. #DataBreach #ThreatIntel #CyberSecurity #DataLeak #France #OSINT #Infosec

🇨🇴 Alleged DefensoresDeLaPatria.com Database Leak Advertised on Breach Forum A threat actor has posted a listing claiming to have obtained and released data allegedly associated with DefensoresDeLaPatria.com, a Colombian political platform. According to the forum post, the actor claims to have exposed approximately 1.45 million records after accessing data allegedly stored on systems associated with the platform. The threat actor alleges the dataset contains: • Identification numbers (Cédula) • First and last names • Email addresses • Municipality and department information • Community and neighborhood data • Referrer information • Referral hierarchy data • Birth dates • User IDs • Electoral-related registration details • Additional profile and registration information The actor shared sample records allegedly containing personal information as proof of possession and claims the data was obtained from services linked to the platform. The post also contains politically motivated statements regarding Colombia's electoral process; however, such claims have not been independently verified. If authentic, the exposure could pose privacy risks to affected individuals and potentially enable phishing, social engineering, and identity-based attacks. At the time of reporting, the authenticity of the dataset, the source of the data, and the extent of any potential compromise remain unverified. ⚠️ The claims remain unverified and should be treated as threat actor assertions until independently validated. #DataBreach #ThreatIntel #CyberSecurity #DataLeak #Colombia #Privacy #OSINT #Infosec #ElectionSecurity #DataExposure

🇧🇷 Alleged CineTela Database Sale Advertised on Breach Forum A threat actor has posted a listing claiming to sell a database allegedly associated with CineTela (cinetelaapp.com), a streaming platform serving Portuguese and English-speaking audiences. According to the forum post, the seller claims the dataset contains approximately: • 3,996,820 user records • 4 GB of CSV data across 176 files • Names and usernames • Email addresses • BCrypt password hashes • Gender information • Birth dates • WhatsApp numbers • Telegram usernames/IDs • Additional user profile metadata The threat actor shared sample records allegedly containing user account information, email addresses, profile attributes, and password hashes as proof of possession. If authentic, the exposure could present risks including credential stuffing attacks, account takeover attempts against users reusing passwords, phishing campaigns, and privacy concerns related to exposed personal information. At the time of reporting, the authenticity of the dataset, the source of the data, and the extent of any potential compromise remain unverified. ⚠️ The claims remain unverified and should be treated as threat actor assertions until independently validated. #DataBreach #ThreatIntel #CyberSecurity #DataLeak #CineTela #Streaming #Privacy #OSINT #Infosec #CredentialLeak #Brazil

🚨 FORTIBLEED: 73,932 Fortinet Firewalls Allegedly Exposed A newly disclosed dataset dubbed "FortiBleed" reportedly contains information associated with 73,932 Fortinet firewalls spanning 194 countries and 21,632 organizations. Organizations across sectors including: 🏦 Banking & Financial Services 🚗 Automotive ✈️ Aerospace & Defense 🏥 Healthcare 🏭 Manufacturing ☁️ Technology & Cloud Services could be impacted if exposed FortiGate devices remain active. Potentially exposed information: • VPN credentials • Administrative accounts • Firewall configurations • LDAP/AD integration details • Internal network information Recommended actions: ✅ Identify internet-facing Fortinet assets ✅ Review authentication logs ✅ Rotate exposed credentials ✅ Audit administrative accounts ✅ Verify firmware versions Fortinet appliances remain a high-value target for threat actors due to their position at the network perimeter. Source : infostealers.com/article/fortib… #Fortinet #FortiGate #FortiBleed #CyberSecurity #ThreatIntel #DataLeak #InfoSec #BlueTeam #SOC #ThreatHunting #hudsonrock

🇬🇧 Alleged Cohabitas.com User Database Advertised on Darkweb Forum A threat actor has claimed to be selling a database allegedly belonging to Cohabitas, a UK-based house-sharing and co-living platform that connects users seeking shared accommodation and community living opportunities. According to the forum post, the dataset is being offered in SQL and CSV formats and is reportedly approximately 1.8 GB in size. The exposed data may include: • User IDs • Usernames • Password hashes • Email addresses • Display names • Registration dates • Account activation data • User status information • Profile-related account details The actor shared sample records that appear to contain user account information, including email addresses and hashed passwords, as proof of possession. The dataset appears to be associated with user accounts registered on the platform, potentially exposing historical account data and authentication-related information. If authentic, potential risks may include: • Account takeover attempts against users reusing passwords • Credential stuffing attacks • Targeted phishing campaigns • Privacy concerns related to housing and profile information • Increased risk of identity-based social engineering At the time of writing, there is no public confirmation from Cohabitas regarding the alleged database exposure, and the authenticity, scope, and origin of the data have not been independently verified. ⚠️ Organizations handling user account data should investigate any claims of unauthorized access and review authentication controls, password storage practices, and monitoring capabilities. #DataBreach #CyberSecurity #ThreatIntel #DataLeak #UnitedKingdom #UK #Privacy #Infosec #CredentialLeak #HousingTech

🇮🇳 Alleged Indian School Student Database Advertised on Breach Forum A threat actor has posted a dataset allegedly containing records associated with students from an Indian educational institution, claiming access was obtained through a third-party service. According to the listing, the dataset purportedly contains: • ~90,500 student records • ~69,500 student photographs • Student names • Parent/guardian names • Dates of birth • Mobile numbers • Residential addresses • Class and section information • Roll numbers The actor shared sample records and numerous student photographs as proof of possession. The exposed records appear to contain information relating to minors, significantly increasing the potential privacy and safeguarding concerns associated with the alleged breach. If authentic, the exposure could present risks including identity theft, targeted social engineering, phishing, harassment, and unauthorized profiling of affected students and their families. At the time of reporting, the source institution has not been identified in the public post, and the authenticity, scope, and origin of the dataset remain unverified. ⚠️ Due to the involvement of minors' information, this alleged incident should be treated as a potentially high-impact privacy event pending further validation. #DataBreach #CyberSecurity #ThreatIntel #DataLeak #India #StudentData #Privacy #Infosec

🇺🇸 Alleged GAP Inc. Customer Database Advertised on Breach Forum A threat actor has published a dataset allegedly associated with GAP Inc., the global apparel retailer behind brands including Gap, Old Navy, Banana Republic, and Athleta. According to the forum post, the dataset purportedly contains: • 256,200 unique email addresses • 152,100 phone numbers • 146,100 residential addresses • Customer account information • Loyalty program data • Additional personally identifiable information (PII) The actor also shared sample records appearing to contain customer and internal account-related information as proof of possession. If authentic, the exposed data could increase the risk of targeted phishing, account takeover attempts, identity fraud, and social engineering attacks against affected individuals. At the time of reporting, the claims remain unverified, and there has been no public confirmation regarding the authenticity of the dataset or the circumstances surrounding the alleged exposure. ⚠️ Threat actor claims should be treated as unverified until independently validated. #DataBreach #CyberSecurity #ThreatIntel #DataLeak #GAP #RetailSecurity #Infosec

🚨 ShinyHunters Expands Leak Site With Multiple New Victims The ShinyHunters extortion portal has added several organizations across the telecommunications, retail, media, energy, manufacturing, and education sectors to its public leak site. Recently listed organizations include: • American Tower Corporation • JCPenney & subsidiaries under Catalyst Brands & Authentic Brands Group • Madison Square Garden Sports Corp. • Ralph Lauren Corporation • Nexstar Media Group • Sysco Corporation • Kodak • Deep Well Services • Glendale Community College • Moody Bible Institute • Illinois Central College (ICC) • Houston Community College System (HCCS) The threat actor alleges the compromise of customer data, employee information, financial records, Salesforce environments, student records, identity documents, payroll data, and internal corporate information, depending on the affected organization. Several listings have transitioned from "warning" status to publicly downloadable disclosures, suggesting negotiations may have failed or disclosure deadlines have expired. ⚠️ The claims published by the threat actor have not been independently verified. The actual scope, authenticity, and impact of the alleged breaches remain subject to validation by the affected organizations. #ShinyHunters #DataBreach #CyberSecurity #ThreatIntel #Ransomware #DataLeak #Infosec

🇮🇳 Alleged ICAI Examination Portal Compromise Claimed by Threat Actor A threat actor has claimed unauthorized access to the ICAI examination platform,infrastructure used in the Chartered Accountancy examination process. According to the forum post, the actor alleges: • Administrative-level access to the examination system • Access to examiner profiles and marking schemes • Access to student answer sheets from the May 2026 examination cycle • Ability to modify question-wise and overall examination marks • Possession of over 200,000 examination-related records The actor also published sample images appearing to show ICAI examination answer sheets and examination processing documents as purported proof of access. If authentic, the claims raise concerns beyond data exposure, potentially impacting examination integrity, grading systems, examiner accounts, and student assessment records. At the time of reporting, the claims remain unverified, and there has been no public confirmation regarding the alleged compromise or the actor's asserted ability to alter examination results. ⚠️ Threat actor statements should be treated as unverified until independently validated. #CyberSecurity #ThreatIntel #DataBreach #ICAI #ICAIExam #EducationSecurity #India #Infosec

keyboard_arrow_left Previous keyboard_arrow_right Next

🇮🇳 Alleged ICAI Member Database Advertised on Breach Forum A threat actor has posted a dataset allegedly containing records associated with members of the Institute of Chartered Accountants of India (ICAI). According to the listing, the dataset purportedly contains over 600,000 records and includes information such as: • Member names • Membership numbers • Email addresses • Mobile numbers • Dates of birth • COP (Certificate of Practice) details • Membership dates • Physical addresses The actor claims the data was sourced in 2026 and has shared sample records as proof of possession. Initial review of the samples suggests the records contain detailed personal and professional information associated with Chartered Accountants. If authentic, the exposure could present risks including targeted phishing, business email compromise (BEC), identity fraud, and professional impersonation attacks against affected members. At the time of reporting, the claims remain unverified and there has been no public confirmation from ICAI regarding the alleged dataset. ⚠️ Threat actor claims should be treated as unverified until independently validated. #DataBreach #ThreatIntel #CyberSecurity #ICAI #CharteredAccountants #India #DataLeak #Infosec

🇮🇳 Alleged Shaadi.com Database Sale Advertised on Breach Forum A threat actor has posted a listing claiming to sell access to and a database allegedly associated with Shaadi.com, one of India's largest matrimonial platforms. According to the forum post, the seller claims: • Database from 2026 • Over 100 million user records • Approximately 40 GB of data • Additional proof allegedly available via private communication At the time of reporting, no samples, technical details, or evidence were publicly provided in the listing to substantiate the claims. The authenticity of the dataset, the source of the data, and the extent of any potential compromise remain unverified. If authentic, such a dataset could potentially expose sensitive user profile information and personal data associated with a large number of platform users. ⚠️ The claims remain unverified and should be treated as threat actor assertions until independently validated. #DataBreach #ThreatIntel #CyberSecurity #DataLeak #Shaadi #India #OSINT #Infosec

🚨 Multiple Organizations Listed on ShinyHunters Leak Site The ShinyHunters extortion portal has recently added several organizations to its leak site, including: • American Tower Corporation • JCPenney and subsidiaries under Catalyst Brands & Authentic Brands Group • Madison Square Garden Sports Corp. • Ralph Lauren Corporation • Nexstar Media Group • Nottingham Trent University (nottingham.ac.uk) • Zayo.com & Allstream.com The threat actor claims to have obtained a range of data, including customer information, corporate records, payment data, identity documents, GIS data, and other internal records. Several listings are marked as "Final Warning Pay or Leak," suggesting ongoing extortion activity ahead of potential public disclosure. At the time of reporting, the claims remain unverified and affected organizations have not publicly confirmed the alleged compromises. Researchers should monitor for additional disclosures, sample releases, or official statements that may clarify the scope and impact of these incidents. ⚠️ Threat actor claims have not been independently verified. #DataBreach #ThreatIntelligence #CyberSecurity #Ransomware #DataLeak #ShinyHunters #ThreatIntel #Infosec

🇮🇳 Reliance Group Listed on World Leaks Leak Site Reliance Group has been added to the World Leaks leak portal, where the organization is currently marked as "Disclosed." At this time, the threat actor has not publicly released technical details regarding the alleged compromise, affected systems, or the volume of data purportedly obtained. Reliance Group is a diversified Indian conglomerate with operations spanning financial services, infrastructure, power generation, healthcare, media, defence, aviation, and transportation. The listing may indicate ongoing extortion activity or a forthcoming data disclosure. No samples, proof-of-compromise, or evidence of impacted records were observed in the publicly accessible listing reviewed by researchers. If authentic, the incident could pose risks to corporate information, employee data, business operations, and third-party stakeholders. Additional disclosures from the threat actor or official statements from the organization may provide further clarity regarding the scope and impact of the alleged breach. ⚠️ The claims remain unverified at the time of reporting. #DataBreach #ThreatIntelligence #CyberSecurity #Ransomware #DataLeak #RelianceGroup #India #Infosec

🚨 Alleged Tata Electronics Data Leak Listed on World Leaks A threat actor has published what appears to be a 630.4 GB dataset containing over 204,000 files allegedly sourced from Tata Electronics. The exposed file structure suggests access to internal manufacturing and engineering environments, including: • FATP & SMT production data • QA/OQC documentation • MES and factory automation systems • PLC and equipment configurations • CAD, fixture, and engineering files • Production test & burn-in logs The leaked directory structure references multiple internal file servers and manufacturing workflows, increasing the likelihood that the dataset is authentic. At this stage, there is no public confirmation from Tata Electronics, and the full extent of the exposure remains unverified. #DataBreach #CyberSecurity #ThreatIntel #DataLeak #ManufacturingSecurity #TataElectronics #Infosec

keyboard_arrow_left Previous keyboard_arrow_right Next

🇯🇵 Nintendo Employee and Internal Communications Data Allegedly Stolen by Extortion Group A threat actor operating under the name ShadowByt3s claims to have compromised Nintendo and is attempting to extort the company by threatening to release allegedly stolen internal data. The group claims to have obtained approximately 859 MB to nearly 1 GB of information and is demanding a $2 million ransom, while imposing a public deadline for contact. According to the post, the threat actor claims the compromised data includes: • Employee full names and email addresses • Internal analytics and reporting data • Survey responses and employee feedback submissions • Exported reports and dashboards • Bank statements and payment-related PDF documents • W-9 and financial documentation containing employee identifiers • Internal recognition and employee engagement records ("cheers") • Progress plans and performance-related exports • Historical reports spanning 2016–2026 • Employee communication analytics and engagement metrics • Internal content libraries and question repositories • Information relating to employee sentiment and workplace feedback • Rankings or engagement-related information involving employees The dataset appears to be: • An alleged exfiltration from an employee engagement and analytics platform • Primarily focused on employee, HR, reporting, and engagement information • Historical in nature, with records allegedly spanning approximately a decade • Being leveraged as part of an extortion attempt rather than a traditional database sale The threat actor specifically references: • Employee analytics platforms • Survey and engagement systems • Exported reporting repositories • Payment and financial documentation • Employee communications and sentiment analysis data • Internal performance and progress-tracking information If authentic, potential risks may include: • Targeted phishing attacks against employees • Business email compromise attempts • Social engineering using internal organizational knowledge • Exposure of sensitive employee feedback and HR information • Privacy concerns involving personnel records • Reputational damage resulting from disclosure of internal communications • Financial fraud risks if payment-related documents were exposed • Increased effectiveness of future attacks through organizational intelligence gathering A notable aspect of the claim is the threat actor's assertion that the data originated from an employee engagement platform and includes historical organizational analytics and reporting data. Such information, if genuine, could provide attackers with valuable insight into internal operations, personnel structures, and employee relationships. At the time of writing, the authenticity of the alleged breach, the claimed data volume, and the extent of any exposure have not been independently verified. The claims originate from a threat actor's extortion post and should be treated as unverified until confirmed by Nintendo or through independent investigation. #CyberSecurity #ThreatIntelligence #Nintendo #DataBreach #DataLeak #Extortion #Ransomware #EmployeeData #Privacy #ThreatActor #OSINT #DarkWebMonitoring #InfoSec #CyberThreats #SecurityIncident #CorporateSecurity #DataExposure #ThreatMonitoring #CyberRisk #IncidentResponse