Dark-Web Posts Claim Angi, The Tour Guy and KPN Data for Sale
Summary
SOCRadar reports dark-web posts claiming to offer data linked to Angi, The Tour Guy, healthcare leads and KPN, plus resurfaced CafeMom credentials. The claims are largely unverified; the CafeMom data is from a 2014 breach.
Key points
- A seller allegedly offered 4 million Angi records for $800, with contact, address and birthdate information.
- A post claimed The Tour Guy suffered an August 2026 breach affecting more than 3.8 million records, including alleged account and payment data.
- Healthcare-related leads allegedly covering Australia, South Korea, Japan and China were advertised, totaling more than 2.3 million records.
- A seller allegedly offered 4.7 million KPN Netherlands customer records for $320, including telecom and billing details.
- A post republished data from the historical 2014 CafeMom breach, reportedly including 2.6 million email addresses and plaintext passwords.
- The article says the data claims are unverified; exposed personal and credential data could enable phishing, fraud, SIM swapping or account takeover.
Article Details
- Event Type
- SOCRadar reported several underground posts advertising or publishing allegedly breached data, including alleged Angi, The Tour Guy, healthcare leads, and KPN databases, and the resurfacing of data from the historical 2014 CafeMom breach.
- Impact
- If the claims are accurate, exposed personal, financial, account, and healthcare-related information could enable phishing, identity theft, fraud, SIM-swap attempts, account takeover, and credential stuffing. The CafeMom data is described as historical, not a new breach; the other breach and sale claims are unverified.
Vendors
Countries
AustraliaThe Tour Guy breach exposing 3.8 million records, and an alleged healthcare leads database covering Australia, South Korea, Japan, and China.China3.8 million records, and an alleged healthcare leads database covering Australia, South Korea, Japan, and China.Japanexposing 3.8 million records, and an alleged healthcare leads database covering Australia, South Korea, Japan, and China.South KoreaGuy breach exposing 3.8 million records, and an alleged healthcare leads database covering Australia, South Korea, Japan, and China.
Industries
HealthcareAngi Data Sale, The Tour Guy Breach, Healthcare Leads, KPN Leak, and CafeMom Data ResurfaceHome servicesSOCRadar Dark Web Team detected a dark web post advertising a database allegedly stolen from Angi, the U.S.-based home services marketplace.TelecommunicationsSOCRadar Dark Web Team detected a post advertising a database allegedly belonging to KPN Netherlands, a telecommunications and IT provider.TravelSOCRadar Dark Web Team detected a post claiming a breach of The Tour Guy, a travel operator and agency.