What a Database Leak Post Actually Claims
A database leak post is a short claim with a field list, a unit, a year and a thread. Reading those four items shows which kinds of data posters say they hold.
Read the investigation →
Brandefense Cybercrime Report 2026 · Data Breach & Leaks
1 January–27 October 2026 · Research edition 1.0
A Leak Post Is A Claim, Not A Breach.
Of 9,409 Blackhole-collected posts mentioning a data breach, about three in five retell the news, and relay alerts repeat forum thread titles. Some of the rest are short claims whose fields, counts and dates are the poster’s own words. We read what they say and how the data is sold.
Posts that say "data breach" 63%
of Blackhole-collected posts that mention "data breach" are news retellings, not leak posts Collected posts, not incidents or market totalsAdvertised terms, not tested services What this number measures →
01Key findings
What Leak Posts Actually Claim
Each finding below is stated in its own unit, with the limit that comes with it. The investigations give the full reasoning and the evidence records.
Field list · share of claims
Share of claims · n = 1,124Emails and names lead the field lists; a password appears in about one claim in five
Share of 1,124 de-duplicated claims whose poster lists the field (one post per claim, three forum-oriented sets).
Email addresses 62%
Names 53%
Physical addresses 44%
Phone numbers 41%
Passwords (any type) 19%
Dates of birth 16%
IP addresses 11%
National ID numbers 6%
Payment cards 3%
Field listed by the posterPasswords (any type)
The list is the poster’s own; nothing was verified. Field parser accuracy on a 40-post holdout: 88% (95% interval 74%-95%).
Source: Brandefense Blackhole, posts created 1 Jan-27 Oct 2026 (post time). Dataset v1.0. Claims, not breaches, victims or sellers.
Chart dataCSV · 607 BOriginal chartSVG · 98.1 KB
+View as table
| Field | Share of claims | 95% interval | Claims |
|---|---|---|---|
| Email addresses | 62% | 59–65% | 1,124 |
| Names | 53% | 50–56% | 1,124 |
| Physical addresses | 44% | 42–47% | 1,124 |
| Phone numbers | 41% | 38–44% | 1,124 |
| Passwords (any type) | 19% | 17–22% | 1,124 |
| Dates of birth | 16% | 14–18% | 1,124 |
| IP addresses | 11% | 9–13% | 1,124 |
| National ID numbers | 6% | 5–8% | 1,124 |
| Payment cards | 3% | 2–4% | 1,124 |
- 01Automated leak-monitor cards tagged "Data leak" re-post forum thread titles. Of 200 cards read by an AI reader, 0 had an organisation's own database as the topic (upper bound 1.9%). Service/SEO adverts, chat and combolists dominated.
- 02In 1,124 database-share claims from forum-oriented sets, contact and identity fields dominate: email 62%, name 53%, address 44%, phone 41%, but a password only 19%.
- 0345% of those claims state no year for the data. Among dated claims, 28% say the data is at least two years old. In the 45 older claims read, the year sat near the top of the post (41 of 45).
- 04Only 68 of 126 posts the rules labelled as sale offers were a seller's own offer. Lead-list sellers attach validity promises more often than breach-database sellers (7 of 9 vs 2 of 11 channels; small samples, intervals overlap slightly).
- 05An estimated 5.5–13% of 1,811 short forum replies challenge or test a leak claim (recounts, sample checks, pointers to earlier leaks).
02The investigations
Three Questions. One Data Set.
Each investigation answers a different question from the same collected posts. Start with the main one, then follow the question that matters to your team.
When a Data Leak Alert Is an SEO Ad: Reading Dark Web Brand Alerts
Data leak alerts are often relay cards pointing at forum adverts. See what a card, a retelling and a first-hand post each prove, and how to triage an alert.
Read the investigation →Breach Databases and Lead Lists Are Sold on Different Terms
Breach database offers lean on a sample; lead lists more often promise validity, and some also promise replacement. One advertiser sits behind much of the lead-list pattern.
Read the investigation →03For defenders
Which Exposure Needs A Response
These are implications of what the posts say, not measured control results. Each one points to a different decision.
-
Let the field list decide the response: contact and identity fields point to phishing and impersonation, so a password reset covers little of that exposure.
-
Treat a size as a claim with a unit: a third of claims give no count, and one post can give two counts far apart.
-
Log the type of every alert, and do not close an alert that names your organisation on the title alone.
-
Count a retold claim once: trace a news item or relay card back to the first claim behind it.
-
Route a sale post with two questions: is the file real, and are these people about to be contacted?
Module
Dark Web Monitoring
See when your company's passwords, data or name show up on criminal forums and markets.
See how it works →
Free exposure check
Request a demo
Check Your Domain.
Free exposure check. Enter your company domain and see what is visible from the outside, in about 30 seconds.
04 / From research to monitoring
From Research To Monitoring.
05Method & limits
How Leak Claims Were Counted
- Source
- Brandefense Blackhole.
- Period
- 1 January–27 October 2026, by post time. October is partial.
- Edition
- Research edition 1.0.
Share of the ~9,400 posts matching the whole-word keyword "data breach" (47 of 48 weekly windows fetched in full) that fixed rules classify as news retelling (64%). We corrected that rule share for errors measured against 70 posts labelled by an AI reader working separately from the rules, giving 63% with a 95% range of 55–69%.
Roughly one in five (16–29%) shares, sells or relays data first-hand.
06Get the research
The Research. Ready To Inspect.
Read the report, open the evidence records and reuse the charts with their source and limits.
HTMLEdition 1.0 Research reportAccessible reading edition · full-year PDF in early 2027 HTML52.7 KB Evidence catalogueThe records the investigations cite HTML6.7 KB Charts & press kitOriginal chart files and attribution
Original aggregate tables, charts and editorial paraphrases: CC BY 4.0. Keep the source, version, date range and measurement limits with reused figures.
30 October 2026 · Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
07 / All chapters
The Other Seven Chapters.
The Cybercrime Report 2026 reads eight kinds of activity in the same collection. Each chapter counts its own unit, so compare their limits before you compare their numbers.
01 · Ransomware 64.7% of claims came from just 33 of 177 groups 02 · Fraud 831 of 2,448 retained financial-account posts match one narrow recruitment signature (33.9%) 04 · Stolen Accounts & Combolists 6.3% of hand-read Botnet Log posts are strict stealer-log clouds (weighted estimate) 05 · Infostealers 97.5% of January-April raw "stealer" keyword posts carried one brand's notification template 06 · Initial Access Offers 38.2% → 4.9% Share of posts under Blackhole's "Initial Access Selling" label that were access offers: 1 Jan–31 Aug vs 12 Sep–27 Oct 2026 07 · Exploits, Tooling & AI 37 of 93 exploit seller posts using the word 0-day that were coded as unnamed-exploit claims 08 · Hacktivism & DDoS 578 distinct NoName057(16) DDoS claim events (1 Jan–27 Oct 2026), carrying 2,920 claimed target entries All eight chapters Open the Cybercrime Report 2026 Eight chapters. Eight units.