DarkOwl Adds Structured Leak Records and Search Features in Q3 2026 Update
Summary
DarkOwl’s Q3 update adds queryable data-leak records and new search and analytics features. The company also details purported leaks involving BOK Financial and PNLD; PNLD publicly acknowledged a July cyber incident exposing contact information.
Key points
- Structured Data Leaks in Vision can be queried and filtered by up to 40 attributes; username and alias searches now include these records.
- DarkOwl says leak records are supported in general search and the Search API; beta access to an upcoming Leaks API is available by request.
- New market reports cover product categories, prices, vendors, marketplace activity, and shipping trends.
- DarkOwl says data purportedly from BOK Financial was posted on ShinyHunters on August 28, 2026; its file-tree analysis found source code, API keys, and tokens among the collected files.
- Data purportedly from PNLD was posted on ExfilSquad on August 3, 2026. PNLD had publicly acknowledged a July 26 incident exposing contact information of police staff, partner organizations, and public users.
- The article says DarkOwl indexed purported leaks attributed to ShinyHunters, including data said to involve the Council of Europe and Carnival Corporation; the claims are attributed to the group’s posts.
Article Details
- Event Type
- Quarterly product and data update covering DarkOwl platform enhancements and reporting on purported data leaks attributed to ShinyHunters and ExfilSquad.
- Impact
- DarkOwl reported indexing purportedly exposed data associated with multiple organizations. The BOK Financial data reportedly included source code, API keys, and tokens; the PNLD data reportedly included law-enforcement contact records that could support targeted phishing and social engineering. DarkOwl also described personal, financial, and other sensitive information in purported Council of Europe and Carnival Corporation data. These breach details are claims attributed to posts or reports, except where PNLD publicly acknowledged a cyber incident exposing contact information.
Threat Actors
ExfilSquadExtortion group that posted purported Police National Legal Database data; the post claimed the leak contained law-enforcement contact records.ShinyHuntersGroup to which DarkOwl attributed several indexed leaks; posts attributed to the group claimed to have exfiltrated data from organizations including BOK Financial, the Council of Europe, and Carnival Corporation.
Vendors
Products
DarkMartDarkMart™, DarkOwl’s structured collection of darknet marketplace content, gives us the listings, vendors, prices, and shipping details to build that view.Entity APIData Leaks in Entity Explore and Entity API: Cryptocurrency, Card, and BIN entities in Entity Explore now include a Data Leak summary box, and Entity API returns data leak information in the response.Leaks APICustomers can request beta access to our upcoming Leaks API, which will add enhanced query functionality and summarization features.Search APIStructured leak content is supported today in general search and the Search API, and more is coming.Usage APIFor teams that use Vision API, the Usage API now supports filtering by date.VisionStructured Data Leaks, now live in Vision, turn each leak into records you can query, filter, and read by field.Vision APIVision UI and Vision API Enhancements
Countries
Industries
Education(Fluke Corporation, American Tower Corporation), financial services (Abrigo, BOK Financial), and education and government (Houston City College, Moody Bible Institute, the Council of Europe).Financial Services[JC Penney]), technology and communications (Fluke Corporation, American Tower Corporation), financial services (Abrigo, BOK Financial), and education and government (Houston City College, Moody Bible Institute,GovernmentCorporation, American Tower Corporation), financial services (Abrigo, BOK Financial), and education and government (Houston City College, Moody Bible Institute, the Council of Europe).healthcare and life sciencesThe victims span industries: healthcare and life sciences (Accord Healthcare, Lumenis), travel and retail (Carnival Corporation, Ralph Lauren, [JC Penney]), technology and communications (Fluke Corporation, AmericanLaw enforcementAccording to the post, the leak contains 135,000 law enforcement contact records, including full names, email addresses, and police jurisdictions.technology and communicationsHealthcare, Lumenis), travel and retail (Carnival Corporation, Ralph Lauren, [JC Penney]), technology and communications (Fluke Corporation, American Tower Corporation), financial services (Abrigo, BOK Financial),travel and retailThe victims span industries: healthcare and life sciences (Accord Healthcare, Lumenis), travel and retail (Carnival Corporation, Ralph Lauren, [JC Penney]), technology and communications (Fluke Corporation, American