Threat Intelligence

Dark Web Sale Claims: Angi, The Tour Guy and an Australian Healthcare Leads List

SOCRadar · 12 Oct 2026

Key Takeaway Warn staff and customers to treat unexpected messages that quote personal or appointment details as suspicious, and use unique passwords with multi-factor authentication on every business account.

SOCRadar's Dark Web Team has reported several new underground posts advertising allegedly stolen data. One seller claims to hold 4 million unique records from Angi, a U.S. home services marketplace, and has listed them for $800. The fields reportedly include names, phone numbers, email and street addresses, and birthdates. Another actor claims a breach of travel operator The Tour Guy that exposed more than 3.8 million records. The claimed data includes password hashes, authentication tokens, billing details and payment card data.

Of most interest to Australian readers, a seller is advertising healthcare-related leads totalling more than 2.3 million records across Australia, South Korea, Japan and China. The claimed Australian portion is 121,000 records. The data reportedly includes names, email addresses, phone numbers, street addresses, appointment history, facility identifiers and registration details. If valid, it could enable healthcare-themed phishing, patient impersonation and medical fraud. SOCRadar also noted posts advertising an alleged KPN Netherlands customer database and a resurfaced historical CafeMom dataset.

All of these claims are unverified. SOCRadar's own wording is conditional: if the data is authentic, it could support phishing, smishing, identity fraud, account takeover and social engineering. Businesses that deal with customers, patients or travel bookings should treat unexpected messages that cite personal details with extra suspicion.

Summarised by CISO AI from SOCRadar, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.