Cyber Attack & Data Breach · socradar.io

SOCRadar Flags Five Alleged Data Leaks and Database Sales

Oct 26, 2026 · Original article ↗

Summary

SOCRadar reports five underground listings: alleged Finaxis[.]cloud, WoWInstaller, Argentine Moodle, MyHairCare Australia and HT Médica datasets. The listings remain unverified; HT Médica’s listing does not establish clinical-record exposure.

Key points

A seller allegedly offered 400GB of Finaxis[.]cloud data, including source code and financial information, for $15,000; the seller claimed the data was obtained after ransom demands were refused.
A resurfaced WoWInstaller database reportedly contains about 1.21 million historical records, including usernames, email addresses and plaintext passwords. Its authenticity is unverified.
An actor using the alias Synq1xxs claimed to expose records from an Argentine Moodle-based education platform, including contact details and course information; the institution’s affiliation is unconfirmed.
A seller identified as JSON09 advertised an alleged MyHairCare Australia database with 1,048,576 customer records, including contact and purchase-related details.
An actor using the alias SpartanX advertised an alleged 2.2-million-record HT Médica database containing personal and identity information. The listing does not establish that clinical records were compromised.

Article Details

Victim Organization: Finaxis.cloud; WoWInstaller; an Argentine educational platform using Moodle (precise institutional affiliation unconfirmed); MyHairCare Australia; HT Médica
Victim Domain: Finaxis.cloud
Incident Type: Multiple unverified data-breach and database-leak or sale claims.
Data Types Exposed: Finaxis.cloud: source code, merchant and partner lists, contact information, financial statements, and banking details (alleged)
WoWInstaller: usernames, email addresses, and plaintext passwords (alleged)
Argentine Moodle platform: names, email addresses, country and time-zone information, course enrollment details, and possibly recent login activity (alleged)
MyHairCare Australia: last names, email addresses, phone numbers, spending and currency information, and geographic details (alleged)
HT Médica: names, dates of birth, DNI numbers, email addresses, gender, phone numbers, and physical addresses (alleged); the listing does not establish that clinical records were compromised
Affected Records: Finaxis.cloud: not disclosed. WoWInstaller: approximately 1.21 million records after duplicate removal. Argentine Moodle platform: not disclosed. MyHairCare Australia: seller claimed 1,048,576 records. HT Médica: seller claimed 2.2 million records.
Affected Data Size: Finaxis.cloud: seller advertised 400GB. Sizes for the other datasets were not reported.
Operational Impact: No operational disruption or confirmed impact was reported. The article describes potential risks including financial fraud, credential stuffing, account takeover, phishing, impersonation, social engineering, and identity theft.
Ransom Or Extortion: For Finaxis.cloud, the threat actor claimed the company’s management refused ransom demands; this claim and the alleged breach are unverified. Other posts advertised datasets for sale, but no ransom demand was reported for them.
Claim Status: alleged