Threat Intelligence

Dark Web Roundup: Alleged ZoomInfo Database Sale and Other Claimed Data Leaks Surface

SOCRadar · 19 Oct 2026

Key Takeaway Treat unexpected emails, texts and calls that use accurate personal or business details with suspicion, and verify payment or account change requests through a separate, trusted channel.

SOCRadar's Dark Web Team has identified several underground posts advertising stolen or leaked data. The largest is a post on the XSS forum offering an alleged 185 million-record database linked to ZoomInfo, a business contact data platform. The seller supplied sample records, but it is not verified whether the data was scraped or obtained through unauthorised access. The listing reportedly includes names, business and personal email addresses, mobile numbers, job titles, LinkedIn profiles and company details. If genuine, it could fuel targeted phishing, Business Email Compromise and corporate impersonation.

In a second claim, an actor using the name sexyskin said they leaked a database from TryCircle, an e-commerce platform in Kuwait. The post lists 557,052 customer records, reportedly containing names, mobile numbers, email addresses and detailed delivery addresses. This kind of data could be used for phishing, smishing, identity fraud and social engineering. The breach has not been independently confirmed.

A third post, from an actor called cantpwn, claims to have released about 903,000 records from Municipalidad de Vicente López, a municipality in Argentina's Buenos Aires Province, covering 2015 to 2026. The roundup also mentions a previously compromised HDB Financial Services dataset being advertised again, and an unverified claim of an X (Twitter) user database leak. All of these are allegations from underground posts, and details remain unconfirmed.

dark web data leak phishing ZoomInfo threat intelligence

Summarised by CISO AI from SOCRadar, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.