DarkOwl Examines Leak Sites Selling Stolen Data Outside Ransomware Groups

Summary

DarkOwl describes smaller leak-focused sites and Telegram channels selling leaked data, accounts and stealer logs, often outside ransomware groups. Analysts say the trend may reflect more decentralized trading; they could not verify data advertised on Unsafe.

Key points

• The article distinguishes standalone leak sites selling data from ransomware groups’ victim blogs, which are used to publicize victims, negotiate, and threaten data publication.
• DarkOwl observed sites offering leaked personal and company data, stealer logs, account access, and combo lists, sometimes alongside other products.
• Telegram channels are used to advertise listings, discuss or request data, and arrange direct deals; DarkOwl says they are more integral to these sites than to traditional darknet marketplaces.
• Unsafe listings included proofs containing personal, financial, and company information, but DarkOwl said it had not verified the authenticity of the advertised data.
• DataCloud and SQLi Cloud were described as offering data or account access, with Telegram channels supporting announcements, discussion, and requests.
• The article says smaller, decentralized sellers may be harder to take down as a single hub, while buyers may face a greater risk of scams.
• DarkOwl presents the rise of these sites as a trend, not as a quantified measurement; it notes that Breached Forums had recently been seized and shut down.