Threat actors insisted that Resecurity’s honeypot was real data. We found no evidence that it was.

Threat actors insisted that Resecurity’s honeypot contained real data, but DataBreaches[.]net says it found no evidence that the data were real. SLH claimed they had hacked Resecurity and obtained “everything,” including internal chats, employee data, threat intel, client lists, and management files, and they continued to assert the data were real. Resecurity, however, denied the allegations and pointed to a December article describing their honeypot deception and the use of synthetic data.

According to Resecurity, the threat actor was observed probing publicly facing services on 21 November 2025, and between 12 December and 24 December the actor made over 188,000 requests attempting to dump synthetic data. DataBreaches reviewed more than 28,000 records claimed as real client data but found that the majority were Gmail addresses with no clear link to clients, and some email addresses appeared to belong to Resecurity employees. DataBreaches found no evidence that SLH acquired any data from Resecurity’s real clients.