SnowTeam Launches Leak Bazaar for Processing and Selling Stolen Corporate Data

Summary

SnowTeam, also known as BlackSnow, says Leak Bazaar processes stolen enterprise data with ML filtering, DBMS reverse engineering, cataloging and analyst review, then offers reports and segmented data sales as ransomware negotiation leverage.

Key points

• The article reports that SnowTeam, posting as BlackSnow, launched Leak Bazaar, a closed exchange for stolen enterprise data.
• Its stated pipeline combines ML filtering, DBMS reverse engineering, automated cataloging and manual analyst validation.
• A beta feature is described as parsing SQL, SAP and Oracle dumps to extract financial transactions, payroll and contractor records.
• Leak Bazaar markets processed reports as leverage in ransomware negotiations, including by surfacing information about sanctions, shadow accounting and unissued financials.
• The platform offers exclusive or shared purchases; submissions are described as needing to be exclusive, primarily English and at least 100 GB, from companies with at least $10 million in revenue.

Threat Actors

Products

Industries

Related Articles

• Researchers Say BOSSAI AI Agents Helped a Taiwan-Based Attacker Steal Taipei Dispatch Recordsthehackernews.comOracle
• Security Roundup: Flowise Exploitation, AI Credential Theft and SAP Riskssecurityweek.comSAP
• 2026 OT Threat Report Finds Physical-Impact Cyber Incidents Fell 25% in 2025github.com/jacobdjwilsonSAP
• Two Tirol Companies Recount EGLO Ransomware Attack and Localmind Intrusiontop.tirolSAP
• Why Intent-Based Access Control Must Account for Uncertaintysophos.comOracle