DarkOwl Adds Site Identification and API Features in Q2 Product Update
Summary
DarkOwl announced Vision UI and API updates, including site identification and filtering features, and highlighted data leaks it collected, with claims and details varying by case.
Key points
- Vision UI now supports inline annotations for case findings and a summary view of findings activity.
- Search API adds a siteId response field and a query parameter to filter by identified website; two Context API endpoints provide site information and lexicon access.
- DarkOwl reported 38% growth in data leak records and highlighted leaks involving Orange, 4chan, LockBit, INTERPOL and a Russian aviation medical center.
- The article says data purportedly from Orange was posted on BreachForums; media reports attributed claims of data theft to a threat actor linked to HellCat.
- The LockBit leak-site defacement exposed affiliate-panel data, according to the article; LockBit claimed no decryption tools or sensitive victim-company data were accessed.
- Claims about the INTERPOL and Russian medical-center datasets are attributed to forum posts; the article notes that some details, including whether certain values were password hashes, could not be confirmed.
Article Details
- Event Type
- Quarterly product update and data-leak intelligence roundup
- Impact
- DarkOwl reported Q2 2025 product enhancements and summarized several datasets purportedly exposed in breaches or posted on underground forums. Reported impacts include exposure of more than 600,000 Orange customer records, a 4chan-related data and source-code leak, compromise of LockBit affiliate data and administrator credentials, purported INTERPOL data exposure, and purported Russian Center of Aviation Medicine records involving 1.1 million people. Some claims and the contents or authenticity of datasets are attributed to posts or media reports and are not independently confirmed in the article.
Threat Actors
Vendors
Products
Context APIAdditionally, to provide greater feature compatibility between Vision UI and API, we have launched two new endpoints within Context API: Site Context API and Site Summary API.Leak Context APIThe descriptions below are all available in our Leak Explore UI feature, or Leak Context API endpoint.Leak Explore UIThe descriptions below are all available in our Leak Explore UI feature, or Leak Context API endpoint.Search APIIn Search API, a new siteId response field is returned with the response for identified websites in the DarkOwl Vision dataset.Vision UIThis quarter, the DarkOwl Product Team doubled down on customer feedback, delivering powerful enhancements across Vision UI and API.