Data Breach & Leaks: The Report
Of 9,409 Blackhole-collected posts mentioning a data breach, about three in five retell the news, and relay alerts repeat forum thread titles. Some of the rest are short claims whose fields, counts and dates are the poster’s own words. We read what they say and how the data is sold.
- 63%
- Of about 9,400 posts that mention “data breach” retell the news95% range 55–69%. The unit is collected posts, not incidents.
- 62%
- Of 1,124 database-share claims list an email addressOnly 19% list a password. The unit is claims de-duplicated by post title, with fields as the poster states them.
- 81.2%
- “Detection Date” posts that are leak-monitor relay cardsn=311,983 posts. Estimated from a sample; volume is not leak volume.
Brandefense / Cybercrime Report 2026 / Data Breach & Leaks Data Breach and Leaks Research 2026 1 January-27 October 2026. Dataset v1.0. Collected posts, not incidents. Get The Data Breach Report.
Read the report, open the evidence records and reuse the charts with their source and limits.
Edition 1.0 · 1 January–27 October 2026 · Free access · 30 October 2026 · Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
Three Investigations. Separate Questions Of The Same Collection.
Three investigations ask separate questions of the same collection, 1 January to 27 October 2026. The first reads 1,124 database-share claims. The second asks what relay "Data leak" cards and news retellings prove. The third compares how organisation databases and marketing lead lists are advertised.
The full-year PDF edition follows in early 2027. The accessible edition carries the same text, numbers and charts as a web page, with headings, chart descriptions and tables that screen readers can follow.
- 01 What a Database Leak Post Actually Claims A database leak post is a short claim with a field list, a unit, a year and a thread. Reading those four items shows which kinds of data posters say they hold. Read online →
- 02 When a Data Leak Alert Is an SEO Ad: Reading Dark Web Brand Alerts Data leak alerts are often relay cards pointing at forum adverts. See what a card, a retelling and a first-hand post each prove, and how to triage an alert. Read online →
- 03 Breach Databases and Lead Lists Are Sold on Different Terms Breach database offers lean on a sample; lead lists more often promise validity, and some also promise replacement. One advertiser sits behind much of the lead-list pattern. Read online →
- 04 Method, limits and the evidence catalogue. A post is not an incident, and an ad does not prove a sale or show that a tool works.
Inspect The Evidence Behind The Report.
Reuse our charts with their source, dates and limits.
Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed. Brandefense analysts reviewed and approved the findings.
AI disclosureBrandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
- 01Posts are not incidents, victims, sellers or transactions. We make no statement that leaks, forums or the dark web grew or shrank, and no forum month-by-month statement, because forum dates in the data are partly day-and-month swapped.
- 02Can be claimed: what a post says, as "the post says". Cannot be claimed: that a stated size, age or field list is true, or that a database is real, fresh or complete.
- 03Cannot be claimed: that a "Data leak" tag verifies a leak.
- 04Counts depend on what Blackhole collected; the corpus ingests late, so totals can change if the windows are pulled again after mid-November.
- 05Examples in the evidence catalogue are paraphrased and coarsened: month only, generic sector, orders of magnitude, no region beside a sector and size, no price amounts.
From Research To Monitoring.
See when your company's passwords, data or name show up on criminal forums and markets.
See how it worksCheck Your Domain.
Free exposure check. Enter your company domain and see what is visible from the outside, in about 30 seconds.
The Other Seven Chapters.
The Cybercrime Report 2026 reads eight kinds of activity in the same collection. Each chapter counts its own unit, so compare their limits before you compare their numbers.