DARKEYE.io

// Research desk

Ransomware and breach intelligence

Two reports a week from the Darkeye research desk: one ransomware operation and one data breach, built on our own monitoring of leak sites, breaches and infostealer logs.

Breaches Weekly, 25–31 Oct 2026. Claimed Paidwork-labelled dataset: 76,155,304 indexed rows, not unique people. Cases: Paidwork, Print.sa.
Latest report Breach Reports

Breaches Weekly, 25–31 Oct 2026: 76.2M Claimed Paidwork Rows and 12.1M Print.sa Records

Indexed 25–31 Oct 2026: claimed Paidwork (76.2M rows) and Print.sa (12.1M) files, with date exceptions, consumer exposure and attribution limits.
Ransomware Weekly, 25–31 Oct 2026. Claimed Pitney Bowes-labelled dataset: 21,299,605 indexed rows, not unique people. Cases: Pitney Bowes, AngMar, Omni Tanker.
Breach Reports

Ransomware Weekly, 25–31 Oct 2026: 21.3M Claimed Pitney Bowes Rows, AngMar and Omni Tanker

Indexed 25–31 Oct 2026: 21.3M Pitney Bowes-labelled rows, 10.6M claimed AngMar records and 1.8M claimed Omni Tanker records, with attribution limits.
Breaches Weekly cover, 18–24 Oct 2026: 9.5M claimed Lalafo records, with Samsung and METRO Russia named below.
Breach Reports

Breaches Weekly, 18–24 Oct 2026: 9.5M Lalafo Records, Claimed Samsung Defect Lists and 2.7M METRO Rows

Claimed leaks indexed 18–24 Oct 2026: a 9.5M-record Lalafo user export, alleged Samsung defect lists (4.6M) and 2.7M METRO Russia customer rows.

// More reports

Ransomware Weekly Breaches Weekly
Ransomware Weekly, 18–24 Oct 2026: 282M MAG-labelled rows posted on Telegram; also Thermos, Goodwill and Southeastern Oklahoma State University.
Breach Reports

Ransomware Weekly, 18–24 Oct 2026: 282M MAG Rows, Clop Lists 65.8M Thermos Records

Leaks indexed 18–24 Oct 2026: MAG-labelled rows (282M), Clop's Thermos claim (65.8M), Goodwill (27.3M) and SE Oklahoma State (9.2M).
Breaches Weekly cover showing a claimed 236 million Manchester airport records, with Loozap and Airtel named below.
Breach Reports

Breaches Weekly, 11–17 Oct 2026: 236M Manchester Airport Rows, 66.7M Loozap Records

Claimed leaks indexed 11–17 Oct 2026: Manchester Airports Group (236.1M), Loozap (66.7M) and Airtel (42.1M). None is independently confirmed.
Ransomware Weekly cover showing 19.6M claimed Inter records, with ITK Holding and Metro Tulsa Foot named below.
Breach Reports

Ransomware Weekly, 11–17 Oct 2026: N0n Lists 19.6M Inter Records; Clop’s ITK Claim Scores Zero

Ransomware listings indexed 11–17 Oct 2026: N0n claims Inter (19.6M), Clop claims ITK Holding (10.7M) and Insomnia lists Metro Tulsa Foot (4.3M).
Breaches Weekly, 4–10 Oct 2026: 642M CDEK rows posted on Telegram (claimed); also CenterPoint and zaimer.kz
Breach Reports

Breaches Weekly, 4–10 Oct 2026: 642 Million CDEK Rows and an Alleged CenterPoint Customer Dump

Claimed leaks indexed 4–10 Oct 2026: a 642M-row CDEK file, an alleged CenterPoint customer dump and 8M zaimer.kz microloan records.
Ransomware Weekly, 4–10 Oct 2026: 36.9M Suunto records dumped by Clop (leaked); also CyrusOne and Pipestone
Breach Reports

Ransomware Weekly, 4–10 Oct 2026: Clop Drops 36.9M Suunto Records, ShinyHunters Dumps CyrusOne

Ransomware leaks indexed 4–10 Oct 2026: Clop drops 36.9M Suunto records, ShinyHunters dumps CyrusOne (8.4M) and Akira leaks Pipestone HR files.
Stealers Take Your Passwords. Breaches Take Your Email. Ransomware Takes Everything.
Breach Reports

Stealers Take Your Passwords. Breaches Take Your Email. Ransomware Takes Everything.

We compared 831 traditional breaches and 124 ransomware leaks indexed in 30 days with a sample of 216 infostealer logs: saved logins vs flat tables vs whole company file servers.
Three leaks opened and read: 2.8B ZenBusiness records leaked by ShinyHunters; also S&P Global and Disney
Breach Reports

Three Leaks Opened: 2.8B ZenBusiness Records, CI Secrets Under S&P Global's Name and Disney HR Tables

We opened the Disney, S&P Global and ZenBusiness leaks: HR tables under a Slack label, other firms' CI secrets, 2.8B warehouse rows with AI logs.
DarkEye logo and 332,262,322 total records
Breach Reports

What's Inside the "European Commission" Ransomware Leak Claimed by ShinyHunters?

What the indexed data of the "European Commission" ransomware leak claimed by ShinyHunters contains: 14% of records hold an email, and 70% of those carry bytedance.com.
Social Links alternatives
Tools

Where Social Links Ends: 5 OSINT Alternatives for 2026

Social Links alternatives for law enforcement and corporate OSINT teams: five platforms compared on social graph analysis, dark web intelligence, and pricing.

// Intel briefing

Ransomware and breach intel, before it trends

Two reports a week from the Darkeye research desk: one ransomware operation and one data breach. Signal only.

By subscribing you agree to the privacy policy. Unsubscribe in one click.