The Hackers Crew That Took a National Police Force With a Stolen Password
A four-handle cluster spent seven weeks stealing admin logins. Then they breached one Nepali IT provider and inherited 170+ government clients in a single post.
UAE Data Breaches in September 2026: 7 Incidents, a 4TB Ministry of Interior Claim, and What It Means
Seven UAE data breaches surfaced on dark web forums in September 2026, including a 4TB Ministry of Interior claim. What leaked, who claimed it, what to do.
Read Briefing
No Zero-Days Needed: What Attackers Exploited in October 2026
A 2017 Struts bug, port 445, Telnet on Windows 2000, phpMyAdmin — plus one new CVE in a service nobody inventories. What criminal sellers actually used last month.
Read Briefing
September's Ransomware Index: The Victims One Group Tried to Hide
September: 956 listings, 79 groups. One group redacted its victims' names — and its own later posts gave 14 of them away. Plus Clop's 25-organisation set.
Read Briefing
Israel Under Fire on the Dark Web: What We Found in September 2026
A threat-intelligence look at the September 2026 spike in Israeli data leaks on the dark web — from municipal ransomware to defense-sector claims
Read Briefing
Alleged ShinyHunters Leader Arrested in Amsterdam: What We Know
ShinyHunters arrest: an alleged leader was detained in Amsterdam with FBI support. The suspect, the group's tactics, and what defenders should do next.
Read Briefing
Ransomware Data Resale: The 12-Day Gap After a Leak Site
Ransomware Data Resale: The 12-Day Gap After a Leak Site On 20 August 2026 the ransomware group pear published four victims to its leak site: a plastic surgery institute, a healthcare billing provider
Read Briefing
Revolut Data Leak: How Fake Italian Police Emails Exposed Crypto Holders
The Revolut data leak wasn't a hack. How fake law enforcement requests exposed crypto holders' KYC data, and why iamnotavillain's ransom fell 99.6%. (148 characters)
Read BriefingThe SINON Ransomware Index, August 2026
1,223 leak-site listings across 82 ransomware groups in August 2026. Qilin and The Gentlemen finished two posts apart, five crews accounted for 42% of the month, and three of the numbers people expect from a monthly index are missing on purpose.
Read Briefing
Qilin, The Gentlemen & the Ransomware Long Tail: August 2026
The Gentlemen and Qilin led August 2026 ransomware claims, while 40 of 68 groups posted five victims or fewer. Why fragmentation makes defense harder.
Read Briefing
Identity Verification Breach: 153M Driver's License Scans Sold
A dark web listing offered 153 million stolen driver's license scans, UV and IR images included. Here's why that points to an ID verification vendor.
Read Briefing
Credentials-as-a-Service: Tracking Eleven Dark Web "Cloud" Brands
Between 1 August and 9 September we logged 82 dark web listings from eleven separate vendors renting access to stolen email credentials rather than selling it outright. Tiered pricing, daily delivery quotas, VIP support and, in five cases, a free trial. This is what the actor tracking shows and what it does not
Read Briefing
SpyCloud Alternatives: Six Options Compared for Smaller Security Teams
SpyCloud leads on credential and account takeover defence, and prices accordingly. If the quote came back higher than your budget, here are the alternatives worth knowing and what each one trades away.
Read Briefing
Dark Web Monitoring Pricing in 2026: What It Actually Costs
Dark web monitoring runs from $44 to $30,000 a month. The range is real, and it is not a difference in data. Here is what each tier buys and how to work out which one you need.
Read Briefing
Ransomware Leak Site Monitoring: How to Know Before Your Name Appears
Ransomware groups publish victims on leak sites days before the press reports them. Here is how leak site monitoring works, what it catches, and why the gap is the most useful thing about it.
Read Briefing
We Analysed 1,125 Dark Web Listings in 30 Days. 83 of Them Sell the Parts to Build a Fake Customer.
Inside the KYC bypass supply chain: a month-long study of identity verification fraud across criminal forums and Telegram.
Read Briefing
Rhysida's Berlin Breach: Inside a 5.79 TB Extortion Listing
Rhysida claims 5.79 TB and 1.44 million files from Berlin's state network, with a 30 BTC demand. What the listing says, what it means, and why the group targeted a city government
Read Briefing
Have I Been Pwned Alternatives for Business
HIBP is the best free breach lookup there is. Where it stops being enough for a company, what to look for instead, and an honest comparison of the paid options.
Read Briefing
Best Dark Web Monitoring Tools for Small Business
Most dark web monitoring assumes you have an analyst. Five criteria that actually matter for a small team, seven tools compared honestly, and how to choose in ten minutes.
Read Briefing
Falcon Ransomware Group: First Three Victims All NYSE-Listed
Falcon, a ransomware group first seen in August 2026, listed Globus Medical, DNOW and Hayward Holdings in 48 hours. All three are NYSE-listed. Here's why.
Read Briefing
Stealer Logs: The Early-Warning System for Account Takeover
Infostealer logs expose corporate credentials and live session cookies days before account takeover. Learn how to triage stealer log alerts and act inside the 48-hour window.
Read Briefing
How Initial Access Brokers Sell Corporate Network Access | Sinon Security
Initial access brokers auction VPN, RDP and domain admin access to ransomware crews. See how IAB listings work, what they cost in 2026, and how to detect exposure early.
Read Briefing
How to Know If Your Company Data Is on the Dark Web
Stolen credentials circulate for weeks before anyone uses them. Where company data appears on the dark web, how to check, and how dark web monitoring closes the gap.
Read Briefing
Police and Military Data Leaks on Dark Web: Eight Countries in Thirty Days
Personnel records from police forces and armed forces in eight countries were offered on underground forums in a single month. What was listed, and why the pattern matters.
Read Briefing