All Breaches published in the Darkweb

MINISTRY OF FOREIGN AFFAIRS OF VENEZUELA [FAKE] A post claiming to be a leak of Venezuela's Ministry of Foreign Affairs (mppre.gob.ve) with 1–2 million records, attributed to 'ShinyHunters' by an account later banned for impersonation and posting fake data. Forum replies state the file is truncated and that the actual content is a COVID-19 database, not Ministry of Foreign Affairs data — the leak is fake.

Cushman & Wakefield In May 2026, the real estate services firm Cushman & Wakefield was the target of a "pay or leak" extortion campaign by the ShinyHunters group. Following the threat, the group publicly published data they alleged had been obtained from the firm, consisting mostly of C&W email addresses along with tens of thousands of external email addresses and corporate contact records. The exposed data was primarily business information, including names, job titles, company addresses and phone numbers.

Berkadia In March 2026, the commercial real estate finance company Berkadia was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they alleged was taken from Berkadia's Salesforce instance, including over 300k unique email addresses as well as names, physical addresses and phone numbers, among other data.

In April 2026, the American insurance holding company Kemper Corporation was named by the ShinyHunters ransomware group in a "pay or leak" extortion campaign. According to the attackers, they gained access to Kemper's Salesforce environment through social engineering as part of a broader campaign targeting hundreds of organisations using the same method. The group later published tens of gigabytes of data that they claimed included internal directory data, Salesforce records, and Stripe payment logs. Among the 269k unique email addresses were names, phone numbers, physical addresses, and partial payment card information, including the last four digits, expiration dates, and card brands. Kemper confirmed the incident and stated that they had engaged third-party cybersecurity experts and notified law enforcement.

In June 2026, telecommunications tower infrastructure company American Tower was targeted in a ShinyHunters "pay or leak" extortion campaign. The group later published data allegedly obtained from the company, containing more than 200k unique email addresses belonging to employees, contractors, customers, and leads. The exposed data also included names, addresses, and phone numbers.

In March 2026, the financial consulting and advisory firm CFGI was the target of a ShinyHunters "pay-or-leak" extortion campaign. The group subsequently publicised data allegedly obtained from CFGI comprising corporate contact information, including 243k unique email addresses, names, phone numbers and physical addresses.

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

In April 2026, the fashion brand Zara was among a number of organisations targeted by the ShinyHunters extortion group as part of their "pay or leak" campaign. The group claimed the breach was related to a compromise of the Anodot analytics platform and subsequently published a terabyte of data allegedly including 95M support ticket records. The data contained 197k unique email addresses alongside product SKUs, order IDs and the market the support ticket originated in. Zara's parent company Inditex advised that the incident didn't affect passwords or payment information.

In June 2026, fashion retailer Ralph Lauren was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published hundreds of gigabytes of data they claimed was obtained from the organisation's Salesforce instance, including 140k unique email addresses along with names, phone numbers, genders and age groups.

In April 2026, the ShinyHunters extortion group listed Vimeo on their extortion portal as part of their "pay or leak" campaign. They subsequently published hundreds of gigabytes of data, predominantly consisting of video titles, technical data and metadata. The data also included 119k unique email addresses, sometimes accompanied by names. Vimeo attributed the exposure to a breach of Anodot, a third-party analytics vendor, and advised the incident does not include "Vimeo video content, valid user login credentials, or payment card information".

In March 2026, the student information system Infinite Campus was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they alleged was taken from Infinite Campus, containing 137k unique email addresses along with names, phone numbers, physical addresses and support tickets. Infinite Campus subsequently sent notifications, advising that the exposed data largely consisted of "names and contact information for school staff" and that "the majority is directory information commonly found on school websites".

Al-Nassr Football players database A leaked database described by the poster as covering AFC league football players and coaches (linked to Al Nassr), attributed to data shared via ShinyHunters. It reportedly includes names, ID numbers, passport details, email addresses, nationality, and player contracts, covering more than 69,000 player passports and over 81,000 coach passports.

This dataset is part of a leak concerning the Council of Europe, published by the ShinyHunters group on 18 June 2026 after ransom negotiations failed, following exploitation of an Oracle PeopleSoft zero-day (CVE-2026-35273). The full leak totals roughly 295GB across ~430,000 files and reportedly includes about 409,000 pay slips for over 10,000 current and former employees (2011-2026), CVs, internal HR documents, and banking and tax information

Data reportedly linked to the European Council / Council of the European Union, an official EU institution that defines the political direction and priorities of the European Union. The filename references ShinyHunters, a threat-actor group known for data-extortion campaigns that publish stolen data when a ransom demand is not paid. No further independently verified details on the scale or date of this incident are available.

Data attributed to the Council of Europe, an international organisation based in Strasbourg, was published by the ShinyHunters group on June 18, 2026, after a ransom deadline passed without payment. The leak totals about 295GB across roughly 430,000 files, obtained via an Oracle PeopleSoft zero-day (CVE-2026-35273), and includes about 409,000 pay slips for over 10,000 current/former employees (2011-2026), 14,000 CVs, 3,700 internal HR documents, banking statements/account numbers, and tax records, spanning HR, the General Secretariat, PACE, and EDQM departments

Exact Sciences Corporation (exactsciences.com) Exact Sciences is a major U.S. molecular diagnostics company headquartered in Madison, Wisconsin, best known for its Cologuard colorectal-cancer screening test and its Oncotype DX oncology diagnostics. This dataset was obtained and published by the ShinyHunters group after the company declined to meet the ransom demand. ~149 GB (compressed) across 39 parts

Chronicle.com is described as breached around 2020, with the poster tentatively attributing the incident to the ShinyHunters threat group. No further details on data fields or record counts are given.

Name: Deep Well Services Date: 2026? Size: 53GB (Compressed) Over 7k records containing customer PII and other internal corporate data was compromised. Description: A leak attributed to the ShinyHunters threat-actor group targeting DeepWell Services, a US company, framed as extortion fallout ('should've paid the ransom') after an apparent refusal to pay a ransom demand. ShinyHunters is a well-known cybercriminal group linked to numerous high-profile corporate data breaches and extortion campaigns.

no info

Name: Beacon Pointe Advisors Date: Feb 2026 Records: ~100k Leaked Data: social security numbers, financial account details, driver's licenses, client pii (~60gb dataset)

Data said to have been published by ShinyHunters from a breach of the Council of Europe, an international organization based in Strasbourg. ShinyHunters claimed the attack on 14 June 2026 and published roughly 295 GB across about 430,000 files on 18 June 2026 after a ransom deadline passed unpaid, via an unauthenticated Oracle PeopleSoft zero-day (CVE-2026-35273). Exposed material spans HR, General Secretariat, PACE and EDQM records, including about 409,000 pay slips for over 10,000 staff (2011-2026), CVs, HR documents, and banking/tax information.

ShinyHunters breached Harvard University systems in late 2025 and claimed to have stolen over 1 million records. The attackers targeted Harvard’s Alumni Affairs and Development systems, exposing sensitive information connected to alumni, donors, students, and affiliates. The leaked data reportedly included names, email addresses, phone numbers, home addresses, donation history, event attendance records, and other personal details.

Now we leak data related to important Israeli companies and partners of war criminal Benjamin Netanyahu. Most of Palestinians lost their jobs in addition to their families and their homes!? We also remember that most of Palestinians are living out of Gaza near you war criminals & maybe they 're living in your neighborhood! The list of Israeli companies are as follows: IAI IAI MALAM ELTA ELBIT RAFAEL ELISRA אנחנו מדליפים נתונים של אנשים בחברות חשובות וגם השותפים בפשע מלחמה ביבי. מתחילת המלחמה רב הפלסטינים איבדו את מקום עבודתם שלהם וזה בנוסף להבתים ומשפחות שלהם לפחות עד שהם יחזרו לעבודתם הפעילויות אלו נמשכות זוכרים שגרים הרבה פלסטינים מחוץ לעזה קרוב אליכם, יא פשועים מלחמים نقوم بتسريب البيانات المتعلقة بالشركات المهمة للاحتلال الصهیوني و أيضًا الشعب الإسرائيلي الذین هم شركاء مجرم الحرب بنيامين نتنياهو أکثر فلسطنیین فقدوا وظائفهم بعد أن فقدوا عائلاتهم ومنازلهم!؟ نستمر هذه الأنواع من العمليات، على الأقل حتى يعود هؤلاء الأشخاص إلى وظائفهم ونتذكر أيضًا أن معظم الناس يعيشون خارج غزة بالقرب منکم یا مجرمي الحرب 😎🇵🇸

4M Lines United Kingdom

Vaccine Records Indonesia

Date: 2025-2026 Records: 22,073 Fields: telegram id, username

✅ Found 248397 results from TodaysULP.txt (removed 20884 duplicates)

done

Date: •••• Records: 537,706 Size: 110 MB (Uncompressed) Format: csv Fields: Ownership, brand, phone numbers, tax ID, email, director Wildberries is basically Russia’s version of Amazon an online shopping app where people buy almost everything.

ThOdido NL & Ben.nl Full leak 15M

Пароль - ansq

Adelante Soluciones Financieras Over 16M unique persons records containing significant PII, financial/transactions (credit cards), KYC and data from TransUnion and Experian (background checks). Records: ~16M Size: 518GB+ (Compressed) Fields: emails, government IDs, credit scores/bureau records, names, phones, addresses, income, device/IP/geo data