Dark Web Listings Claim Bank Dump, Government Registry Leak and Webmail Access for Sale

SOCRadar's Dark Web Team has identified a series of underground posts advertising stolen access and data. One lists alleged webmail access to a Canadian infrastructure company said to earn more than $10 million a year. The seller did not name the organisation or provide evidence. If genuine, that kind of access could enable business email compromise, credential theft and phishing, and could open the door to further access to corporate systems.

A second post claims to offer a database dump from an unnamed US financial institution. The actor says it includes production and staging databases with customer details, loan records and transaction histories. The listing also claims access to 492 AWS Secrets Manager values, around 7,000 sensitive keys, Jenkins credentials, SSH private keys and AWS administrative privileges. Sample records reportedly contain names, Social Security numbers and dates of birth. If authentic, the exposure could lead to financial fraud, identity theft and compromise of the institution's cloud infrastructure.

A group calling itself MortemTeam also claims to have leaked more than 20 million records linked to the Peruvian government's national registry systems. Other posts advertise an alleged breach of retailer Spencer's and millions of business contact records reportedly sourced from ZoomInfo. These claims have not been independently verified, and the source excerpt does not provide further detail on the last three.