SOCRadar Tracks Five Unverified Dark-Web Access and Data Exposure Claims
Summary
SOCRadar identified five underground listings alleging Canadian corporate webmail access, a US bank data dump, a Peru registry leak, a Spencer’s breach and a ZoomInfo contact-data sale. The claims and data origins were not independently verified.
Key points
- An actor using the alias Horsefucker advertised alleged webmail access to an unnamed Canadian infrastructure company; the listing provided no organization name or supporting evidence.
- An actor known as huanhoahong claimed to offer an unnamed US bank’s databases and cloud credentials, including AWS secrets, SSH keys and Jenkins credentials; the claims were not independently verified.
- MortemTeam claimed to have leaked more than 20 million records associated with Peru’s national registry systems, including identity and taxpayer numbers; no agency or intrusion method was identified.
- The actor scarlettgroup claimed to have released about 461.8 million Spencer’s database records, reportedly associated with more than 1.55 million customer accounts; the claim remains unverified.
- A seller using the alias LeadsGig advertised about 30 million business leads allegedly associated with ZoomInfo; the listing did not establish whether the data came from unauthorized access, scraping or previously distributed datasets.
Article Details
- Victim Organization
- Multiple alleged targets or data subjects: an unnamed Canadian infrastructure company, an unnamed US financial institution, Peruvian government registry systems, Spencer’s, and data allegedly associated with ZoomInfo. None of the breach claims is independently verified.
- Incident Type
- Multiple unverified claims involving webmail access offered for sale, database dumps or leaks, and business-contact data offered for sale.
- Data Types Exposed
- Customer names and contact details
- Social Security numbers
- Dates of birth
- Loan records
- Transaction histories
- Financial data
- DNI national identity numbers
- RUC taxpayer identifiers
- Physical addresses
- Password hashes
- Loyalty card information
- Payment records
- Marketing data
- Business email addresses
- Company phone numbers
- Job titles and seniority levels
- Company locations, industry classifications, revenue information, and employee counts
- Cloud and infrastructure credentials, keys, and configuration data
- Affected Records
- Claims include more than 20 million Peruvian government-related records; approximately 461.8 million Spencer’s database records, including information associated with more than 1.55 million customer accounts; and approximately 30 million business leads allegedly associated with ZoomInfo. The US financial-institution listing gave no record count.
- Affected Data Size
- Not disclosed
- Operational Impact
- No operational disruption or confirmed compromise is reported. The listed exposures and access claims remain unverified; the article describes potential risks if authentic.
- Ransom Or Extortion
- No ransom demand or extortion is reported. Several listings advertised data or access for sale.
- Claim Status
- claimed
Threat Actors
HorsefuckerThe actor allegedly advertised webmail access to an unnamed Canadian infrastructure company. The access claim remains unverified.huanhoahongThe actor advertised an alleged database dump and claimed access to data and credentials from an unnamed US financial institution. The claims have not been independently verified.MortemTeamA group identifying itself as MortemTeam claimed to have leaked more than 20 million records associated with Peruvian government registry systems. The alleged leak remains unconfirmed.ScarlettgroupThe actor allegedly claimed to have released Spencer’s database records. The breach claim remains unverified.
Products
AWS Secrets ManagerThe listing also claimed access to 492 AWS Secrets Manager values, approximately 7,000 sensitive keys, Terraform state files, Jenkins credentials, SSH private keys, and AWS administrative privileges.JenkinsThe listing also claimed access to 492 AWS Secrets Manager values, approximately 7,000 sensitive keys, Terraform state files, Jenkins credentials, SSH private keys, and AWS administrative privileges.TerraformThe listing also claimed access to 492 AWS Secrets Manager values, approximately 7,000 sensitive keys, Terraform state files, Jenkins credentials, SSH private keys, and AWS administrative privileges.ZoomInfoOther posts advertised an alleged Spencer’s retail database breach and millions of business contact records reportedly sourced from ZoomInfo.
Countries
CanadaThe listing identified Canada as the target country and webmail as the access type but did not disclose the organization’s name, email domain, or supporting evidence.PeruAlleged Peru Government Registry Leak Exposes 20M+ RecordsUnited StatesAlleged US Bank Database Dump and Cloud Credentials Are Advertised
Industries
Business intelligence and contact dataSOCRadar Dark Web Team detected an underground listing advertising approximately 30 million business leads allegedly associated with ZoomInfo, a business intelligence and contact data platform.Governmentcompany, a claimed US banking database dump involving sensitive credentials, and an alleged Peruvian government registry leak affecting more than 20 million records.Infrastructureidentified several underground posts, including an alleged webmail access sale targeting a Canadian infrastructure company, a claimed US banking database dump involving sensitive credentials, and an alleged PeruvianRetailOther posts advertised an alleged Spencer’s retail database breach and millions of business contact records reportedly sourced from ZoomInfo.