Threat Intelligence

Dark Web Posts Claim Data Theft From Payment, Gaming, Education and Healthcare Targets

SOCRadar · 26 Oct 2026

Key Takeaway Use a unique password for every service and turn on multi-factor authentication, so that old leaked credentials cannot be used to break into your business accounts.

SOCRadar's Dark Web Team has identified a series of underground posts advertising allegedly stolen data. The most significant involves Finaxis.cloud, a payment processing platform serving high-risk industries such as iGaming. A threat actor claims to hold 400GB of internal information after the company's management allegedly refused a ransom demand. The data reportedly includes full source code, merchant and partner lists, agent and trader contact details, financial statements and banking details. The seller is offering parts of the data individually, or the full set for $15,000. If genuine, it could enable financial fraud and targeted attacks on business partners.

Another post shares an alleged historical database from WoWInstaller, a now-defunct World of Warcraft guild services provider. The seller says it dates from a breach around 2017 and holds about 1.21 million records, including usernames, email addresses and plaintext passwords. Its authenticity is unverified, but old credentials can still fuel credential stuffing and account takeover where people reused passwords on other services.

A third post claims to expose user information from an Argentine educational platform running Moodle. The actor, using the alias Synq1xxs, shared sample records tied to an education management system called MEC. SOCRadar also reported posts advertising an alleged MyHairCare Australia customer database and an alleged HT Médica database of 2.2 million records. All of these claims remain unverified.

dark web data breach credential stuffing extortion Australia

Summarised by CISO AI from SOCRadar, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.