SOCRadar reports alleged data leaks across five organisations

SOCRadar Dark Web Team identified a series of underground posts claiming various data exposures. Alleged Finaxis[.]cloud data sale reports 400GB of information from a payment processing platform serving high‑risk industries, including iGaming. The post claims access to full source code, merchant and partner lists, P2P agent and trader contact details, financial statements and banking information, with components offered separately or as a complete dataset for $15,000.

The poster says the breach followed management’s purported refusal of ransom, raising potential for financial fraud and targeted attacks against Finaxis[.]cloud partners.

A resurfaced WoWInstaller database is claimed to contain around 1.21 million records after deduplication from a breach dated circa 2017, featuring usernames, email addresses and plaintext passwords. SOCRadar notes the service is defunct, but historic credentials could enable credential stuffing and account takeover if users reuse passwords elsewhere; authenticity of the database remains unverified.

Separately, an Argentine Moodle data leak is alleged by an actor using the alias Synq1xxs, claiming exposure of user information from an Argentine educational platform identified as MEC, with sample records including full names, email addresses, country, time zone, and course enrolments; there is no confirmed institutional affiliation.

Further, a MyHairCare Australia database sale is advertised, alleging 1,048,576 records dated 18 October 2026, including customer surnames, emails, phone numbers, total spending, currency and geographic details, offered for $300 with a sample link. Finally, a 2.2 million‑record HT Médica dataset is claimed, containing personal details such as names, dates of birth, DNI, emails, telephone numbers and addresses; the listing notes a potential privacy risk but does not confirm clinical records were compromised. All claims are attributed to the respective posters or outlets cited by SOCRadar.