Threat Intelligence

Dark Web Roundup: University Leak, Israeli Firm Access Sale, and Massive Data Dumps

SOCRadar · 14 Sept 2026

Key Takeaway Australian SMBs should monitor for exposed credentials and remote access tools like VPN gateways, and use dark web monitoring to catch stolen data or access listings before they are exploited.

SOCRadar's Dark Web Team has identified several new underground posts of concern to businesses and institutions. One claims to leak a database from Universidad Cuauhtémoc (UCQ) in Mexico, exposing roughly 381,000 student and staff records including names, institutional emails, registration numbers and CURP identifiers, data that could fuel phishing and identity theft campaigns.

Separately, an initial access broker is auctioning alleged Domain Admin level access to an Israeli manufacturing company reportedly generating $80 million in annual revenue, with GlobalProtect cited as the access vector. Starting bids were set at $2,000 with a $6,000 buy-it-now price; if genuine, this kind of access could allow ransomware deployment or long-term intrusion.

Another post advertises an alleged 900GB data dump from Digital Nirvana Inc., claimed to contain around 1.6 million files from 2004 to 2022, including financial records, KYC documents, payroll data and digital signing certificates. Additional listings referenced an alleged 32baar.com customer database and a Ghorer Bazar e-commerce breach involving more than 4.2 million records.

dark web data breach initial access broker threat intelligence

Summarised by CISO AI from SOCRadar. We link back to every original so you can read it yourself.