Rivanorth

We've redesigned our entire UI from the ground up. Because detecting data leaks should be easy. AI analyses each alert. Categorises it, writes the description. Automatically closes false positives. An analyst only needs 2 clicks to double check the finding and resolve it.

The Centro de Atención de Género, a gender-violence support centre in the Argentine province of Corrientes, has been listed on a dark web forum. The actor claims to have accessed its case system, which they say was protected by the password 123123, and shows records of victims and alleged aggressors, including names, addresses, ID numbers and dates of birth, along with photos of identity documents. No record count is given. Credibility: 3/5. A sample that fits the victim, but no count and a new account; not independently verified.

Sanitas USA, the US branch of healthcare group Keralty, has been listed on a dark web forum. The actor claims to be giving away records of 200,000 US residents, including names, dates of birth, addresses, Social Security numbers, phone numbers and prescription details, and shows a sample. Credibility: 4/5. A detailed sample that fits the claim, though from a new account; not independently verified.

RTO (Revisión Técnica Obligatoria), Argentina's mandatory vehicle inspection service, has been listed on a dark web forum. The actor claims to be leaking about 500,000 vehicle inspection records, including plate numbers, inspection results and owners' names and tax IDs, and shows a sample. The actor calls it their group's first release. Credibility: 5/5. A sample matching Argentine records and a specific count from an established account; not independently verified.

Medal[.]tv, a US gaming clip-sharing platform, has been listed on a dark web forum. The actor claims to be leaking 4,004,633 user profiles from a 2024 breach, including usernames and linked Discord, Steam, Xbox, Riot and Twitch accounts, and shows a sample. Credibility: 5/5. A sample that fits the platform and an exact count from an established account; not independently verified.

Capiter, an Egyptian B2B startup that the actor says shut down in 2023, has been listed on a dark web forum. The actor claims to be giving away the data of more than 208,000 users, including names, phone numbers, locations and order histories, and shows a sample. Credibility: 5/5. A sample that fits the company and a specific count from an established account; not independently verified.

Cyprus's Deputy Ministry of Research, Innovation and Digital Policy has been listed on a dark web forum over its Gigabit voucher broadband grant scheme. The actor claims to be leaking 72,920 applications to the scheme from 2025, including applicants' names, ID numbers, addresses and phone numbers, and shows a sample. Credibility: 5/5. A sample that fits the scheme and a specific count from an established account; not independently verified.

Pubali Bank Securities, a Bangladeshi securities brokerage, has been listed on a dark web forum. The actor claims a full compromise of its main EC2 server through SQL injection, and to be releasing its database, source code, signatures and KYC documents. They say its websites have been offline for at least five days. Credibility: 3/5. A specific claim from an established account, but the evidence is only linked, not shown; not independently verified.

Ocean Edu, a Vietnamese English-language school chain with more than 150 branches, has been listed on a dark web forum. The actor claims to be giving away records of more than 2 million students, about 4 GB, including names, birthdays, phone numbers, ID and passport numbers and online passwords, plus more than 80,000 student photos. The actor says they were once a student there. Credibility: 5/5. A detailed sample that fits the school and a specific count from an established account; not independently verified.

GetSuper.ai, a Californian AI productivity software company, has been listed on a dark web forum. The actor is re-sharing 2.26 GB of data first leaked by the Everest ransomware group and reported in April 2026. The download sits behind the forum's points paywall. Credibility: 2/5. Re-share of an earlier leak with no sample shown, though from an established actor; not independently verified.

Saratoga Casino, a US casino in Saratoga Springs, New York, has been listed on a dark web forum. The actor has released 2,000 player records with names, dates of birth, email addresses and home towns, and says the remaining 600,000 records will go on sale within seven days. It is the same actor who listed Island View Casino a day earlier. Credibility: 4/5. Sample fits the casino's New York customers, but the actor is new; not independently verified.

ACF Assurances, a French insurance brokerage, has been listed on a dark web forum. The actor claims to be leaking 23,000 policyholder records with names, email addresses, mobile numbers, dates of birth and home addresses, and shows a sample of records created in mid-2023. The full file is released to anyone who replies to the thread. Credibility: 5/5. Detailed sample from an established actor; not independently verified.

Cooperativa Virgen del Cisne, an Ecuadorian savings and credit cooperative, has been listed on a dark web forum. The actor claims to be selling 1.5 million online banking records with names, ID numbers, email addresses, passwords, account numbers and biometric codes, plus cloud access, documents and photographs, for $40,000 to $100,000. A sample of customer records is posted with the passwords masked. Credibility: 4/5. Sample fits the cooperative's Ecuadorian members, but the actor's history is not shown; not independently verified.

Afpa, France's national adult vocational training agency, has been listed on a dark web forum. The actor claims 971,000 records described as new data, and shows a sample with names, dates of birth, home addresses, phone numbers and vehicle registrations. The rest sits behind the forum's points paywall. Credibility: 4/5. Sample fits French records, but the actor is new; not independently verified.

An unnamed Omani energy infrastructure organisation has been listed on a dark web forum. The actor claims to be selling full access to its systems, obtained in 2026 through a PHP web shell, together with a database. The asking price is 35,000 USDT, through escrow. Credibility: 2/5. No sample, no named victim and no detail beyond the price, though the seller is established; not independently verified.

she's back!

Epic Games, the US maker of Fortnite and Unreal Engine, has been listed on a dark web forum. The actor claims to be selling four valid GitHub tokens belonging to members of the Epic Games organisation, with read access to its private repositories, including the Unreal Engine source code, and CI/CD workflow access on two of them. The asking price is 0.15 BTC, about US$9,500, for all four. Credibility: 2/5. No data or token shown and the seller is a new account, though the claim is specific; not independently verified.

Hospital Nacional Cayetano Heredia, a public hospital in Lima run by Peru's Ministry of Health, has been listed on a dark web forum. The actor claims 14.8 million records on 2.5 million people, including national ID numbers, home addresses, medical record numbers, triage notes with the reason for each visit, and insurance identifiers. Credibility: 4/5. Sample fits the hospital's patient system, but the actor is new; not independently verified.

Island View Casino, a US casino resort in Mississippi, has been listed on a dark web forum. The actor has released 2,000 records with people's names, dates of birth, physical descriptions and home addresses, and says the remaining 735,000 records will go on sale within five days. Credibility: 4/5. Sample fits the casino's Mississippi location, but the actor is new; not independently verified.

Aakash Healthcare, an Indian hospital group in New Delhi, has been listed on a dark web forum. The actor claims 3 million patient records, demographics and patient reports, and is selling them for US$10,000. Credibility: 5/5. Sample fits patients in the hospital's area of Delhi; not independently verified.

NTC Group, a Cambodian education group, has been listed on a dark web forum. The actor claims 6 GB of data taken in October 2026, including 92,421 student records with national ID numbers and profile photos, 63,916 canteen accounts and 4,675 staff logins, and says access to two branches' school management system is still for sale. The same actor listed Cambodia's National Employment Agency a day earlier. Credibility: 5/5. Sample fits the school's records and comes from an established actor; not independently verified.