One card in our Telegram collection carries the tag “Data leak” and lists a source, a content line, a detection date and a type. The source is a marketing forum, and the content line advertises search-ranking backlinks, so nothing in the card refers to stolen data (record DB-E015).
The tag did not come from the thread, because an automated monitor writes the same Type value on every card, and all 26,282 cards we fetched carry it. A second card, from a Russian-language forum, places an earnings slogan under the same tag (DB-E016). Data leak alerts of this kind are common: the phrase “Detection Date” alone matches about 312,000 posts between 1 January and 27 October 2026.
An estimated 81% of those posts are leak-monitor relay cards over the whole period, although the share declines from roughly 91% in January to roughly 70% in October. CVE-feed cards (12%) and ransomware-feed cards (6%) account for nearly all of the remainder.
If a card like this names your brand, what does it tell you? We examined 200 of them, then compared the results with the news retellings and first-hand posts that arrive under a “data breach” label. Counts are Blackhole-collected posts, mostly from Telegram, and they are not incidents, victims or sellers.
What 200 Relay Cards Were About
An AI reader classified the content line of 200 cards, 100 from the full week of 8 March and 100 from a sampled September week. The relayed thread was most often general discussion or another topic (57 of 200, including 12 proxy lists), a service or SEO advertisement (47) or a combolist (37). Carding or fraud advertisements accounted for 24, and the remaining 35 were hacking tools, courses, ransomware or news threads, stealer logs and access sales.
An organisation’s own database was the topic in 0 of 200 cards, an upper bound of 1.9% at 95% confidence. That zero depends on one classification choice, because three cards were credential-line files named after a company, which we coded as combolists. Counting those three as organisation leaks would give 3 of 200 (1.5%).
The SEO marketing forum could be producing the zero, because it supplied 75 of the 200 cards and none of them was a combolist or a database. Without it, none of the remaining 125 cards concerned an organisation’s database (upper bound 3%), and combolists rise to 30% of what is left. In the full week of 8 March, the 6,539 cards came from 26 forums, and 32% came from that one SEO forum, which is not a breach forum.
An earlier AI read looked different at first sight, because it found 4 of 32 relay cards on-topic. Those cards came from pools that the platform classifier had already labelled for data breach, database sharing or data leak, which a random sample of cards does not do.
Cards That Name a Company
Readers care most about cards that name them, so we also identified which of the 200 name a company, brand, platform or domain. Ninety-five did (48%), often the advertiser’s own name, and the proportion was similar in both frames. Of those 95, 67 were advertisements or general discussion, while 28 offered credentials, logs, combos or account and card data.
The 28 were 16 combolists or credential files, one stealer-log file and 11 account or card-data sales, and none offered an organisation’s own database. A card that names a company, mostly an advertiser or a service named in a credential list, is therefore an advertisement or general discussion about seven times in ten.
It is a credential file or an account sale about three times in ten, and the tag cannot distinguish between the two, because it is identical on every card.
A title that points at a data claim does exist, and one catalogued card names a company and a seven-figure count (DB-E017). It gives no field list, breach date or price, so it cannot tell a free share from a sale or a repost.
Because we selected it for the catalogue, it illustrates the form of such a card and not a rate. The classifications in this section are one AI reader’s judgment, and seller-brand names were counted as named.
Where News Retellings Fit
Cards are one signal among several. The keyword pool for “data breach” holds about 9,400 posts collected between 1 January and 27 October 2026. News retelling is the largest component at 64% by rule, or 55% to 69% after correcting for the measured error of the rules. First-hand posts are 16% to 29%, and they include relay cards, since about three in five Telegram first-hand posts by rule are cards.
One news aggregator channel carries 36% of the pool, and 99% of its posts are retellings. We therefore tested the result without that channel, which leaves 6,002 posts, and news is still the largest type by rule at 44%, ahead of first-hand at 27%. On Telegram alone, where post dates are reliable, news retelling accounts for 73% to 85% of the pool’s posts in every month.
Whether fewer leaks were posted as the year went on is a question this pool cannot answer. Forum dates in the collection are partly day-and-month swapped, so we say nothing about when forum posts changed.
A retelling can also duplicate a single claim. A Telegram threat-intel channel said an actor “allegedly leaked” a platform’s user database, listed the claimed fields and relayed the actor’s complaint that the company ignored contact (DB-E019). The post followed the forum release by a day and reproduced its field list almost word for word, so a feed that counted both would count the claim twice.
That is one example and not a measured rate, but it shows how an alert feed can count a single claim twice. Our own rule engine labelled a similar retelling as a sale offer because of the word “demands” (DB-E020), although reading it showed no offer.
Signal by Signal: What Each One Proves
The table sets the signal types side by side. Its third column matters most for anyone who must decide whether to escalate an alert.
| Signal | What it proves | What it does not prove | Check next |
|---|---|---|---|
| Relay card tagged “Data leak” | A forum thread with that title was seen by the automated monitor. | That any data was published, or that the thread is about a database at all. | Read the content line for your names, then retrieve the original thread. |
| News headline with a link | An outlet or a news channel reported a security incident. | That anyone is sharing or selling the data it describes. | Follow the link to the affected organisation’s own notice. |
| Retelling of a forum release | A forum claim existed and another channel repeated it. | That the channel repeating the claim holds the data. | Find the first claim and count the alert only once. |
| First-hand share on a forum | A poster asserted holding data and gave fields, size or age. | That the data is genuine, complete or recent. | Examine the post itself, as the main investigation explains. |
| Priced sale offer | Someone advertised data under stated commercial terms. | That any sale or delivery actually took place. | Read the sale terms, as the sale-terms companion explains. |
A Triage Rule for Brand Alerts
Apply these steps in order. No alert that names your organisation should be closed on the title alone.
- Name the form of the item, because a relay card or a headline is only a pointer, whereas a specific claim about data sits in the body of a post.
- Read the content line for your names, listing your brand, domains and product identifiers in advance. A card that names none of them and no data can be logged as a keyword match, but a card that names you proceeds to step 3.
- Trace the item to the original by retrieving the thread through your monitoring provider, or by finding the first claim behind a retelling so that you count it once.
- Route the alert by what the original is. In our read, about three in ten cards that named any company were credential files or account sales. If the original shows credentials tied to your service, route it to credential reset and fraud review, and compare a database claim with your own records.
For the response itself, see what to do after a breach in our glossary. Credential files and combolists are covered in our stolen accounts and combolists chapter, and stealer logs in the infostealer chapter.
Log the Type, Not Just the Count
Record the signal type on every alert. A quarterly figure for “dark web mentions” built from relay cards would consist mostly of service advertisements, combolists and carding or fraud advertisements. Those groups held 47, 37 and 24 of our 200 cards. Such a figure would follow the relay’s own sources and not your exposure.
Counted by type, the same quarter shows how many items were pointers, retellings and claims about your data. A team that uses dark web monitoring or a data leak detection workflow can then report the claims separately, since only they bear directly on breach risk.
Where the Other Pieces Go
Our main investigation of data-leak posts shows what first-hand claims list. The companion on breach database sales and lead lists covers the sale terms behind priced offers. Ransomware-feed cards make up an estimated 6% of “Detection Date” posts, so the same form-first reading applies in the ransomware chapter. The whole set sits in the data breach chapter of the Cybercrime Report 2026.
Scope and Method
The pool shares come from fixed rules, corrected with a sample of 70 keyword-pool posts labelled by an AI reader working separately from the rules, so they are ranges. On news retelling the rules matched that reader on 44 of 48 posts (92%). Calibrating on all 260 labels from six pools would give 49% to 61% news. The rules found 9 of the 13 first-hand posts in the 70, so the first-hand range rests on small numbers.
The 200 cards and the brand-name tags were read by one AI reader with no second rater, and the 100 September cards are a sample, not a full week. Records DB-E015 to DB-E020 come from the evidence catalogue of selected posts, read by an AI reader, and selection is not prevalence.
Posts are not incidents, victims, sellers or transactions. The data covers 1 January to 27 October 2026 by post time, October is partial, and the collection is dominated by Telegram.
Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.
Brandefense analysts reviewed and approved the findings.
