SOCRadar reports unverified claims of breaches and data sales

SOCRadar’s Dark Web Team flagged multiple underground posts, including a claim of webmail access to a Canadian infrastructure company offered for sale by the actor calling themselves Horsefucker. The listing specifies Canada as the target and webmail as the access type, but does not reveal the organisation name, email domain or supporting evidence.

The team notes that if legitimate, compromised webmail could enable business email compromise, credential theft and wider access to corporate systems; however, the claim remains unverified.

The researchers also surfaced advertisements of a purported US banking database dump and cloud credentials from an unnamed US financial institution, attributed to user huanhoahong, with purported production and staging databases containing customer information, loan histories and 492 AWS Secrets Manager values among other sensitive items.

In addition, a post from MortemTeam claimed more than 20 million records tied to Peru’s national government registry systems, including DNI numbers, RUC identifiers and addresses, though no sample or compromised agency was identified. A separate entry alleges a Spencer’s database breach exposing about 461.8 million records across multiple categories, and another listing advertises roughly 30 million ZoomInfo business leads. All claims are unverified or unconfirmed as presented.