{ "version": "1.0", "built_date": "2026-10-30", "chapter_key": "data-breach", "title": "Data Breach and Leaks Research 2026", "creator": "Brandefense Research Team", "source": "Brandefense Blackhole", "period": { "start": "2026-01-01", "end": "2026-10-27", "label": "1 January–27 October 2026", "date_field": "post.created_at (post__created_at__), never ingest time", "partial_month": "2026-10", "windows": "at most 7 days, inside one calendar month; exact totals from the API", "date_semantics": "Recorded post dates. Forum dates are partly day/month swapped, so no forum monthly series is published." }, "rules": { "version": "dbl-rules-1.3", "rules_py_sha256": "2da7f6a091d3a22e35ae8fe6bc759f963cbc74b796fdf33df7d5ee2b01dbe378", "frozen_before_labelling": true }, "sources": [ { "id": "blackhole", "name": "Brandefense Blackhole", "description": "Dark web and Telegram post collection; post time field post__created_at__." }, { "id": "windows", "file": "retrieval-windows.csv", "description": "One row per set and window: exact total, fetched n, mode." }, { "id": "agg", "file": "data/agg/*.csv (team folder, aggregates)", "description": "Monthly and period aggregates from rules dbl-rules-1.3." }, { "id": "checks", "file": "evidence/checks/results.json", "description": "Rule validation against an AI reader, calibration, relay-card study, source-forum shares." }, { "id": "catalog", "file": "evidence/catalog/results.json + catalog.json", "description": "Template anatomy, parser validation, sale-term sample, 44 evidence records." }, { "id": "validation", "file": "validation/README.md", "description": "260 posts labelled by one AI reader (aggregate tables only)." } ], "headline_metrics": [ { "id": "news-share-k-data-breach", "label": "News retelling share of \"data breach\" posts", "value": 0.6263, "unit": "share", "definition": "Share of the 9,409 posts matching the keyword \"data breach\" (1 Jan-27 Oct 2026) that retell news, by fixed rule dbl-rules-1.3, corrected with the confusion table of 70 posts read by an AI reader working separately from the rules.", "caveat": "Pool is Blackhole-collected posts, Telegram-dominated; one reader, 70 labels; interval covers calibration uncertainty only. Safe range: about three in five (55%-69%). Pooling all 260 labels gives 56% [49%-61%].", "n": 9409, "ci95_low": 0.5539, "ci95_high": 0.692, "source_file": "evidence/checks/results.json", "result_key": "A2.k_subset_n70.ALL.adj_news", "rule_share": 0.6407 }, { "id": "first-hand-share-k-data-breach", "label": "First-hand share of \"data breach\" posts", "value": 0.2248, "unit": "share", "definition": "Share of the same pool that is a forum share, a sale offer or a relayed forum card (rule group first_hand_leak_posts), corrected as above.", "caveat": "Includes relay cards that the reader judged off-topic. Safe range: roughly one in five (16%-29%); sensitivity up to 33%.", "n": 9409, "ci95_low": 0.1624, "ci95_high": 0.2921, "source_file": "evidence/checks/results.json", "result_key": "A2.k_subset_n70.ALL.adj_firsthand", "rule_share": 0.1752 }, { "id": "first-hand-on-topic-share", "label": "First-hand and on-topic share of \"data breach\" posts", "value": 0.1782, "unit": "share", "definition": "First-hand posts that the reader also judged to concern a breach, leak or database being shared, sold or reported.", "caveat": "No rule-level equivalent exists; calibration from 70 labels.", "n": 9409, "ci95_low": 0.1195, "ci95_high": 0.2418, "source_file": "evidence/checks/results.json", "result_key": "A2.k_subset_n70.ALL.adj_firsthand_ontopic_only" }, { "id": "telegram-news-share-range", "label": "Telegram-only monthly news share range", "value": [ 0.7253, 0.8504 ], "unit": "share_range", "definition": "Lowest and highest monthly share of news retelling among Telegram posts in the \"data breach\" pool (dates reliable on Telegram).", "caveat": "Range only; 6,605 fetched Telegram posts. No forum monthly series is published.", "n": 6605, "ci95_low": null, "ci95_high": null, "source_file": "data/agg/k_data_breach_telegram_monthly.csv", "result_key": "C.telegram.n_posts" }, { "id": "detection-date-relay-share", "label": "\"Detection Date\" posts that are leak-monitor relay cards", "value": 0.812, "unit": "share", "definition": "Share of the 311,983 posts containing the phrase \"Detection Date\" (whole period) that are cards from the leak-monitor relay.", "caveat": "Estimated from 31,105 fetched posts in 229 sampled pages and 2 full windows; interval is sampling error only. Whole period only.", "n": 311983, "ci95_low": 0.7985, "ci95_high": 0.8255, "source_file": "data/agg/detection_date_composition.csv", "result_key": "detection_date_composition:2026-01..2026-10" }, { "id": "stated-data-age-ge2", "label": "Share of share posts with a stated year that say the data is 2+ years old", "value": 0.2801, "unit": "share", "definition": "Among 614 database-share claims that state an obtained year, share whose stated year is at least two years before the post year.", "caveat": "The age is what the poster says, not a verified age. 45% of claims state no year.", "n": 614, "ci95_low": 0.2461, "ci95_high": 0.3169, "source_file": "evidence/catalog/results.json", "result_key": "A.by_claim_key.age_ge2" }, { "id": "year-stated", "label": "Share of share-post claims that state when the data was obtained", "value": 0.5463, "unit": "share", "definition": "Share of 1,124 de-duplicated database-share claims (one post per claim) with a stated obtained year.", "caveat": "Claim-level; parser v2 holdout accuracy for obtained year is 95% (38 of 40).", "n": 1124, "ci95_low": 0.517, "ci95_high": 0.5752, "source_file": "evidence/catalog/results.json", "result_key": "A.by_claim_key.year_stated" }, { "id": "password-listed", "label": "Share of share-post claims listing a password field", "value": 0.194, "unit": "share", "definition": "Share of 1,124 de-duplicated claims whose field list includes a password of any type.", "caveat": "Field-list parser holdout accuracy 88% (35 of 40). Among 218 claims that list a password, about 40% say hashed and about 12% plaintext.", "n": 1124, "ci95_low": 0.1719, "ci95_high": 0.2181, "source_file": "evidence/catalog/results.json", "result_key": "A.by_claim_key.any_password" }, { "id": "relay-top-source-share", "label": "Share of March relay cards from the largest source forum", "value": 0.3166, "unit": "share", "definition": "Among 6,539 relay cards in the full week of 8-14 March, share whose relayed thread comes from the largest source forum family.", "caveat": "The largest source is an SEO and marketing forum, not a breach forum. One week only. Forum name not published.", "n": 6539, "ci95_low": 0.3054, "ci95_high": 0.3279, "source_file": "evidence/checks/results.json", "result_key": "B.march_full_week.top1" }, { "id": "relay-card-service-share", "label": "Relay cards whose thread is a service, SEO advert or job", "value": 0.235, "unit": "share", "definition": "Share of 200 relay cards read by an AI reader (100 from the full March week, 100 from a September sample) whose relayed forum thread is a service, SEO advert or job offer.", "caveat": "Cards were read by one AI reader; sample, not census. September half is a sampled window.", "n": 200, "ci95_low": 0.1816, "ci95_high": 0.2984, "source_file": "evidence/checks/results.json", "result_key": "B.both.service/job/recruitment" }, { "id": "template-first-hand-share", "label": "Template-subtype posts read that were first-hand shares", "value": 0.72, "unit": "share", "definition": "In a seeded read of 100 forum template posts, 72 were a first-hand share; 16 were replies or bumps, 9 sale or extortion ads, 2 not a share, 1 unclear.", "caveat": "One AI reader; the rule label forum_share is not a clean first-hand label.", "n": 100, "ci95_low": 0.6251, "ci95_high": 0.7986, "source_file": "evidence/catalog/results.json", "result_key": "A.ptype_among_100_read" } ], "charts": [ { "id": "chart-field-mix", "title": "Emails and names lead the field lists; a password appears in about one claim in five", "svg": "chart-field-mix.svg", "png": "chart-field-mix.png", "csv": "chart-field-mix.csv", "alt": "Horizontal bars, share of 1,124 de-duplicated database-share claims listing each field, with 95 percent intervals: Email addresses 62% (59% to 65%); Names 53% (50% to 56%); Physical addresses 44% (42% to 47%); Phone numbers 41% (38% to 44%); Passwords (any type) 19% (17% to 22%); Dates of birth 16% (14% to 18%); IP addresses 11% (9% to 13%); National ID numbers 6% (5% to 8%); Payment cards 3% (2% to 4%). Fields are what the poster states, not verified.", "n": 1124, "data": [ { "field": "email", "label": "Email addresses", "share": 0.621, "ci95_low": 0.5923, "ci95_high": 0.6489, "n": 1124, "share_by_post_id": 0.5887, "n_post_ids": 1967 }, { "field": "name", "label": "Names", "share": 0.5294, "ci95_low": 0.5001, "ci95_high": 0.5584, "n": 1124, "share_by_post_id": 0.545, "n_post_ids": 1967 }, { "field": "address", "label": "Physical addresses", "share": 0.4448, "ci95_low": 0.416, "ci95_high": 0.474, "n": 1124, "share_by_post_id": 0.4504, "n_post_ids": 1967 }, { "field": "phone", "label": "Phone numbers", "share": 0.411, "ci95_low": 0.3826, "ci95_high": 0.4401, "n": 1124, "share_by_post_id": 0.4148, "n_post_ids": 1967 }, { "field": "any_password", "label": "Passwords (any type)", "share": 0.194, "ci95_low": 0.1719, "ci95_high": 0.2181, "n": 1124, "share_by_post_id": 0.1795, "n_post_ids": 1967 }, { "field": "dob", "label": "Dates of birth", "share": 0.1575, "ci95_low": 0.1373, "ci95_high": 0.1799, "n": 1124, "share_by_post_id": 0.1769, "n_post_ids": 1967 }, { "field": "ip", "label": "IP addresses", "share": 0.1103, "ci95_low": 0.0933, "ci95_high": 0.13, "n": 1124, "share_by_post_id": 0.1012, "n_post_ids": 1967 }, { "field": "national_id", "label": "National ID numbers", "share": 0.0605, "ci95_low": 0.048, "ci95_high": 0.076, "n": 1124, "share_by_post_id": 0.0615, "n_post_ids": 1967 }, { "field": "payment_card", "label": "Payment cards", "share": 0.0276, "ci95_low": 0.0195, "ci95_high": 0.0389, "n": 1124, "share_by_post_id": 0.0346, "n_post_ids": 1967 } ] }, { "id": "chart-data-age", "title": "Half of the stated data ages fall in the posting year; 28% say the data is two or more years old", "svg": "chart-data-age.svg", "png": "chart-data-age.png", "csv": "chart-data-age.csv", "alt": "Horizontal bars, stated age of the data in claims that give an obtained year. Among 614 de-duplicated database-share claims that state an obtained year: Same year as the post 49% (45% to 53%); 1 year earlier 23% (20% to 26%); 2-4 years earlier 16% (13% to 19%); 5-9 years earlier 9% (7% to 11%); 10 or more years earlier 3% (2% to 5%). Two years or older: 28% (25% to 32%). Age is what the poster states.", "n": 614, "data": [ { "bucket": "0", "label": "Same year as the post", "kind": "bucket", "share": 0.4935, "ci95_low": 0.4541, "ci95_high": 0.5329, "n": 614 }, { "bucket": "1", "label": "1 year earlier", "kind": "bucket", "share": 0.2264, "ci95_low": 0.195, "ci95_high": 0.2611, "n": 614 }, { "bucket": "2-4", "label": "2-4 years earlier", "kind": "bucket", "share": 0.1564, "ci95_low": 0.1298, "ci95_high": 0.1872, "n": 614 }, { "bucket": "5-9", "label": "5-9 years earlier", "kind": "bucket", "share": 0.0896, "ci95_low": 0.0695, "ci95_high": 0.1148, "n": 614 }, { "bucket": "10+", "label": "10 or more years earlier", "kind": "bucket", "share": 0.0342, "ci95_low": 0.0225, "ci95_high": 0.0517, "n": 614 }, { "bucket": "ge2", "label": "At least 2 years earlier (sum of last three)", "kind": "cumulative", "share": 0.2801, "ci95_low": 0.2461, "ci95_high": 0.3169, "n": 614 }, { "bucket": "ge5", "label": "At least 5 years earlier", "kind": "cumulative", "share": 0.1238, "ci95_low": 0.1, "ci95_high": 0.1522, "n": 614 } ] }, { "id": "chart-k-data-breach-composition", "title": "Roughly three in five posts that mention \"data breach\" retell the news", "svg": "chart-k-data-breach-composition.svg", "png": "chart-k-data-breach-composition.png", "csv": "chart-k-data-breach-composition.csv", "alt": "Ranges for the composition of 9,409 posts matching the keyword data breach. News retelling: adjusted 63% (55% to 69%), sensitivity 56% (49% to 61%), rule 64%; First-hand (share, sale or relay card): adjusted 22% (16% to 29%), sensitivity 27% (23% to 33%), rule 18%; First-hand and on topic: adjusted 18% (12% to 24%), sensitivity 14% (10% to 20%). Corrected using 70 posts read by one AI reader.", "n": 9409, "data": [ { "group": "news_retelling", "label": "News retelling", "rule_share": 0.6407, "adjusted_share": 0.6263, "ci95_low": 0.5539, "ci95_high": 0.692, "sensitivity_share": 0.557, "sens_ci95_low": 0.4872, "sens_ci95_high": 0.6127, "n_pool": 9409, "calibration_n": 70, "sensitivity_calibration_n": 260 }, { "group": "first_hand_incl_relay_cards", "label": "First-hand (share, sale or relay card)", "rule_share": 0.1752, "adjusted_share": 0.2248, "ci95_low": 0.1624, "ci95_high": 0.2921, "sensitivity_share": 0.2707, "sens_ci95_low": 0.226, "sens_ci95_high": 0.3319, "n_pool": 9409, "calibration_n": 70, "sensitivity_calibration_n": 260 }, { "group": "first_hand_and_on_topic", "label": "First-hand and on topic", "rule_share": null, "adjusted_share": 0.1782, "ci95_low": 0.1195, "ci95_high": 0.2418, "sensitivity_share": 0.1426, "sens_ci95_low": 0.1028, "sens_ci95_high": 0.1958, "n_pool": 9409, "calibration_n": 70, "sensitivity_calibration_n": 260 } ] }, { "id": "chart-relay-card-mix", "title": "A relay card repeats a forum thread title; most threads are adverts, chat or credential lists", "svg": "chart-relay-card-mix.svg", "png": "chart-relay-card-mix.png", "csv": "chart-relay-card-mix.csv", "alt": "Horizontal bars, what the forum thread behind each of 200 relay cards read by an AI reader was about, with 95 percent intervals: Chat or other 57 of 200 (23% to 35%); Service, SEO advert or job 47 of 200 (18% to 30%); Credential list (combolist) 37 of 200 (14% to 24%); Carding or fraud advert 24 of 200 (8% to 17%); Ransomware or news 10 of 200 (3% to 9%); Hacking tool, software, crack 9 of 200 (2% to 8%); Course, guide, e-book 8 of 200 (2% to 8%); Stealer logs 6 of 200 (1% to 6%); Access sale 2 of 200 (0% to 4%); Organisation's own database 0 of 200 (0% to 2%). Without the SEO forum (125 cards) credential lists rise to 30 percent and the organisation-database row stays at 0 of 125.", "n": 200, "data": [ { "thread_topic": "chat/other", "label": "Chat or other", "count": 57, "n": 200, "share": 0.285, "ci95_low": 0.227, "ci95_high": 0.3512, "count_without_seo_forum": 22, "n_without_seo_forum": 125, "share_without_seo_forum": 0.176, "wo_ci95_low": 0.1192, "wo_ci95_high": 0.2521 }, { "thread_topic": "service/job/recruitment", "label": "Service, SEO advert or job", "count": 47, "n": 200, "share": 0.235, "ci95_low": 0.1816, "ci95_high": 0.2984, "count_without_seo_forum": 16, "n_without_seo_forum": 125, "share_without_seo_forum": 0.128, "wo_ci95_low": 0.0803, "wo_ci95_high": 0.1978 }, { "thread_topic": "combolist/credential list", "label": "Credential list (combolist)", "count": 37, "n": 200, "share": 0.185, "ci95_low": 0.1373, "ci95_high": 0.2446, "count_without_seo_forum": 37, "n_without_seo_forum": 125, "share_without_seo_forum": 0.296, "wo_ci95_low": 0.223, "wo_ci95_high": 0.3811 }, { "thread_topic": "carding/fraud", "label": "Carding or fraud advert", "count": 24, "n": 200, "share": 0.12, "ci95_low": 0.082, "ci95_high": 0.1723, "count_without_seo_forum": 20, "n_without_seo_forum": 125, "share_without_seo_forum": 0.16, "wo_ci95_low": 0.106, "wo_ci95_high": 0.2342 }, { "thread_topic": "ransomware/news", "label": "Ransomware or news", "count": 10, "n": 200, "share": 0.05, "ci95_low": 0.0274, "ci95_high": 0.0896, "count_without_seo_forum": 10, "n_without_seo_forum": 125, "share_without_seo_forum": 0.08, "wo_ci95_low": 0.044, "wo_ci95_high": 0.141 }, { "thread_topic": "hacking tool/software/crack", "label": "Hacking tool, software, crack", "count": 9, "n": 200, "share": 0.045, "ci95_low": 0.0239, "ci95_high": 0.0833, "count_without_seo_forum": 6, "n_without_seo_forum": 125, "share_without_seo_forum": 0.048, "wo_ci95_low": 0.0222, "wo_ci95_high": 0.1008 }, { "thread_topic": "course/guide/ebook", "label": "Course, guide, e-book", "count": 8, "n": 200, "share": 0.04, "ci95_low": 0.0204, "ci95_high": 0.0769, "count_without_seo_forum": 6, "n_without_seo_forum": 125, "share_without_seo_forum": 0.048, "wo_ci95_low": 0.0222, "wo_ci95_high": 0.1008 }, { "thread_topic": "stealer logs", "label": "Stealer logs", "count": 6, "n": 200, "share": 0.03, "ci95_low": 0.0138, "ci95_high": 0.0639, "count_without_seo_forum": 6, "n_without_seo_forum": 125, "share_without_seo_forum": 0.048, "wo_ci95_low": 0.0222, "wo_ci95_high": 0.1008 }, { "thread_topic": "access sale", "label": "Access sale", "count": 2, "n": 200, "share": 0.01, "ci95_low": 0.0027, "ci95_high": 0.0357, "count_without_seo_forum": 2, "n_without_seo_forum": 125, "share_without_seo_forum": 0.016, "wo_ci95_low": 0.0044, "wo_ci95_high": 0.0565 }, { "thread_topic": "database/leak of an organisation's data", "label": "Organisation's own database", "count": 0, "n": 200, "share": 0.0, "ci95_low": 0.0, "ci95_high": 0.0188, "count_without_seo_forum": 0, "n_without_seo_forum": 125, "share_without_seo_forum": 0.0, "wo_ci95_low": 0.0, "wo_ci95_high": 0.0298 } ] }, { "id": "chart-detection-date-composition", "title": "Four in five \"Detection Date\" posts are cards from one leak-monitor relay", "svg": "chart-detection-date-composition.svg", "png": "chart-detection-date-composition.png", "csv": "chart-detection-date-composition.csv", "alt": "Horizontal bars, composition of 311,983 posts containing the phrase Detection Date, whole period: Leak-monitor relay cards 81.2% (79.9% to 82.6%); CVE-feed cards 12.4% (11.2% to 13.5%); Ransomware-feed cards 6.1% (5.1% to 7.1%); Other 0.3% (0.2% to 0.4%). Estimated from 31,105 fetched posts.", "n": 311983, "data": [ { "card_type": "relay_leak_monitor_card", "label": "Leak-monitor relay cards", "share": 0.812, "ci95_low": 0.7985, "ci95_high": 0.8255, "est_posts": 253340, "exact_total": 311983, "n_fetched": 31105, "pages_sampled": 229 }, { "card_type": "cve_feed_card", "label": "CVE-feed cards", "share": 0.1238, "ci95_low": 0.1124, "ci95_high": 0.1352, "est_posts": 38629, "exact_total": 311983, "n_fetched": 31105, "pages_sampled": 229 }, { "card_type": "ransomware_card", "label": "Ransomware-feed cards", "share": 0.0612, "ci95_low": 0.0511, "ci95_high": 0.0712, "est_posts": 19088, "exact_total": 311983, "n_fetched": 31105, "pages_sampled": 229 }, { "card_type": "intel_feed_alert", "label": "Third-party intel alerts", "share": 0.0, "ci95_low": 0.0, "ci95_high": 0.0, "est_posts": 0, "exact_total": 311983, "n_fetched": 31105, "pages_sampled": 229 }, { "card_type": "other", "label": "Other", "share": 0.003, "ci95_low": 0.002, "ci95_high": 0.004, "est_posts": 926, "exact_total": 311983, "n_fetched": 31105, "pages_sampled": 229 } ] }, { "id": "chart-sale-terms-by-template", "title": "Per ad template, lead-list sales and organisation-database sales carry different terms", "svg": "chart-sale-terms-by-template.svg", "png": "chart-sale-terms-by-template.png", "csv": "chart-sale-terms-by-template.csv", "alt": "Grouped bars, share of ad templates carrying each term (13 organisation-database templates, 12 lead-list templates), with 95 percent intervals: Sample offered or shown, Organisation database sale: 9 of 13; Sample offered or shown, Lead-list sale: 6 of 12; Sample refused (\"no tester\"), Organisation database sale: 0 of 13; Sample refused (\"no tester\"), Lead-list sale: 5 of 12; Guarantee, replacement or escrow, Organisation database sale: 2 of 13; Guarantee, replacement or escrow, Lead-list sale: 8 of 12; Freshness or validity promise, Organisation database sale: 2 of 13; Freshness or validity promise, Lead-list sale: 10 of 12; Sale unit not stated, Organisation database sale: 6 of 13; Sale unit not stated, Lead-list sale: 3 of 12. Small read sample; a pattern, not a proportion of the market.", "n": 25, "data": [ { "group": "org_db", "group_label": "Organisation database sale", "counting_unit": "template_key", "term_field": "sample", "term_value": "offered", "term_label": "Sample offered or shown", "units_with_value": 9, "n_units": 13, "share": 0.6923, "ci95_low": 0.4237, "ci95_high": 0.8732 }, { "group": "org_db", "group_label": "Organisation database sale", "counting_unit": "posts", "term_field": "sample", "term_value": "offered", "term_label": "Sample offered or shown", "units_with_value": 9, "n_units": 13, "share": 0.6923, "ci95_low": 0.4237, "ci95_high": 0.8732 }, { "group": "org_db", "group_label": "Organisation database sale", "counting_unit": "channel", "term_field": "sample", "term_value": "offered", "term_label": "Sample offered or shown", "units_with_value": 7, "n_units": 11, "share": 0.6364, "ci95_low": 0.3538, "ci95_high": 0.8483 }, { "group": "lead_list", "group_label": "Lead-list sale", "counting_unit": "template_key", "term_field": "sample", "term_value": "offered", "term_label": "Sample offered or shown", "units_with_value": 6, "n_units": 12, "share": 0.5, "ci95_low": 0.2538, "ci95_high": 0.7462 }, { "group": "lead_list", "group_label": "Lead-list sale", "counting_unit": "posts", "term_field": "sample", "term_value": "offered", "term_label": "Sample offered or shown", "units_with_value": 7, "n_units": 16, "share": 0.4375, "ci95_low": 0.231, "ci95_high": 0.6682 }, { "group": "lead_list", "group_label": "Lead-list sale", "counting_unit": "channel", "term_field": "sample", "term_value": "offered", "term_label": "Sample offered or shown", "units_with_value": 7, "n_units": 9, "share": 0.7778, "ci95_low": 0.4526, "ci95_high": 0.9368 }, { "group": "org_db", "group_label": "Organisation database sale", "counting_unit": "template_key", "term_field": "sample", "term_value": "refused", "term_label": "Sample refused (\"no tester\")", "units_with_value": 0, "n_units": 13, "share": 0.0, "ci95_low": 0.0, "ci95_high": 0.2281 }, { "group": "org_db", "group_label": "Organisation database sale", "counting_unit": "posts", "term_field": "sample", "term_value": "refused", "term_label": "Sample refused (\"no tester\")", "units_with_value": 0, "n_units": 13, "share": 0.0, "ci95_low": 0.0, "ci95_high": 0.2281 }, { "group": "org_db", "group_label": "Organisation database sale", "counting_unit": "channel", "term_field": "sample", "term_value": "refused", "term_label": "Sample refused (\"no tester\")", "units_with_value": 0, "n_units": 11, "share": 0.0, "ci95_low": 0.0, "ci95_high": 0.2588 }, { "group": "lead_list", "group_label": "Lead-list sale", "counting_unit": "template_key", "term_field": "sample", "term_value": "refused", "term_label": "Sample refused (\"no tester\")", "units_with_value": 5, "n_units": 12, "share": 0.4167, "ci95_low": 0.1933, "ci95_high": 0.6805 }, { "group": "lead_list", "group_label": "Lead-list sale", "counting_unit": "posts", "term_field": "sample", "term_value": "refused", "term_label": "Sample refused (\"no tester\")", "units_with_value": 8, "n_units": 16, "share": 0.5, "ci95_low": 0.28, "ci95_high": 0.72 }, { "group": "lead_list", "group_label": "Lead-list sale", "counting_unit": "channel", "term_field": "sample", "term_value": "refused", "term_label": "Sample refused (\"no tester\")", "units_with_value": 2, "n_units": 9, "share": 0.2222, "ci95_low": 0.0632, "ci95_high": 0.5474 }, { "group": "org_db", "group_label": "Organisation database sale", "counting_unit": "template_key", "term_field": "guarantee", "term_value": "mentioned", "term_label": "Guarantee, replacement or escrow", "units_with_value": 2, "n_units": 13, "share": 0.1538, "ci95_low": 0.0433, "ci95_high": 0.4223 }, { "group": "org_db", "group_label": "Organisation database sale", "counting_unit": "posts", "term_field": "guarantee", "term_value": "mentioned", "term_label": "Guarantee, replacement or escrow", "units_with_value": 2, "n_units": 13, "share": 0.1538, "ci95_low": 0.0433, "ci95_high": 0.4223 }, { "group": "org_db", "group_label": "Organisation database sale", "counting_unit": "channel", "term_field": "guarantee", "term_value": "mentioned", "term_label": "Guarantee, replacement or escrow", "units_with_value": 2, "n_units": 11, "share": 0.1818, "ci95_low": 0.0514, "ci95_high": 0.477 }, { "group": "lead_list", "group_label": "Lead-list sale", "counting_unit": "template_key", "term_field": "guarantee", "term_value": "mentioned", "term_label": "Guarantee, replacement or escrow", "units_with_value": 8, "n_units": 12, "share": 0.6667, "ci95_low": 0.3906, "ci95_high": 0.8619 }, { "group": "lead_list", "group_label": "Lead-list sale", "counting_unit": "posts", "term_field": "guarantee", "term_value": "mentioned", "term_label": "Guarantee, replacement or escrow", "units_with_value": 11, "n_units": 16, "share": 0.6875, "ci95_low": 0.444, "ci95_high": 0.8584 }, { "group": "lead_list", "group_label": "Lead-list sale", "counting_unit": "channel", "term_field": "guarantee", "term_value": "mentioned", "term_label": "Guarantee, replacement or escrow", "units_with_value": 4, "n_units": 9, "share": 0.4444, "ci95_low": 0.1888, "ci95_high": 0.7333 }, { "group": "org_db", "group_label": "Organisation database sale", "counting_unit": "template_key", "term_field": "validity", "term_value": "promise", "term_label": "Freshness or validity promise", "units_with_value": 2, "n_units": 13, "share": 0.1538, "ci95_low": 0.0433, "ci95_high": 0.4223 }, { "group": "org_db", "group_label": "Organisation database sale", "counting_unit": "posts", "term_field": "validity", "term_value": "promise", "term_label": "Freshness or validity promise", "units_with_value": 2, "n_units": 13, "share": 0.1538, "ci95_low": 0.0433, "ci95_high": 0.4223 }, { "group": "org_db", "group_label": "Organisation database sale", "counting_unit": "channel", "term_field": "validity", "term_value": "promise", "term_label": "Freshness or validity promise", "units_with_value": 2, "n_units": 11, "share": 0.1818, "ci95_low": 0.0514, "ci95_high": 0.477 }, { "group": "lead_list", "group_label": "Lead-list sale", "counting_unit": "template_key", "term_field": "validity", "term_value": "promise", "term_label": "Freshness or validity promise", "units_with_value": 10, "n_units": 12, "share": 0.8333, "ci95_low": 0.552, "ci95_high": 0.953 }, { "group": "lead_list", "group_label": "Lead-list sale", "counting_unit": "posts", "term_field": "validity", "term_value": "promise", "term_label": "Freshness or validity promise", "units_with_value": 14, "n_units": 16, "share": 0.875, "ci95_low": 0.6398, "ci95_high": 0.965 }, { "group": "lead_list", "group_label": "Lead-list sale", "counting_unit": "channel", "term_field": "validity", "term_value": "promise", "term_label": "Freshness or validity promise", "units_with_value": 7, "n_units": 9, "share": 0.7778, "ci95_low": 0.4526, "ci95_high": 0.9368 }, { "group": "org_db", "group_label": "Organisation database sale", "counting_unit": "template_key", "term_field": "unit", "term_value": "not_stated", "term_label": "Sale unit not stated", "units_with_value": 6, "n_units": 13, "share": 0.4615, "ci95_low": 0.2321, "ci95_high": 0.7086 }, { "group": "org_db", "group_label": "Organisation database sale", "counting_unit": "posts", "term_field": "unit", "term_value": "not_stated", "term_label": "Sale unit not stated", "units_with_value": 6, "n_units": 13, "share": 0.4615, "ci95_low": 0.2321, "ci95_high": 0.7086 }, { "group": "org_db", "group_label": "Organisation database sale", "counting_unit": "channel", "term_field": "unit", "term_value": "not_stated", "term_label": "Sale unit not stated", "units_with_value": 6, "n_units": 11, "share": 0.5455, "ci95_low": 0.2801, "ci95_high": 0.7873 }, { "group": "lead_list", "group_label": "Lead-list sale", "counting_unit": "template_key", "term_field": "unit", "term_value": "not_stated", "term_label": "Sale unit not stated", "units_with_value": 3, "n_units": 12, "share": 0.25, "ci95_low": 0.0889, "ci95_high": 0.5323 }, { "group": "lead_list", "group_label": "Lead-list sale", "counting_unit": "posts", "term_field": "unit", "term_value": "not_stated", "term_label": "Sale unit not stated", "units_with_value": 3, "n_units": 16, "share": 0.1875, "ci95_low": 0.0659, "ci95_high": 0.4301 }, { "group": "lead_list", "group_label": "Lead-list sale", "counting_unit": "channel", "term_field": "unit", "term_value": "not_stated", "term_label": "Sale unit not stated", "units_with_value": 3, "n_units": 9, "share": 0.3333, "ci95_low": 0.1206, "ci95_high": 0.6458 } ] } ], "validation": { "intra_rater": { "n": 30, "type_agreement": "29/30", "kappa": 0.961 }, "notes": "One AI reader per study; intervals are Wilson 95% and describe sampling error only.", "files": [ "validation.json", "validation.html", "rule-precision.csv", "parser-accuracy.csv", "w2-set-precision.csv", "relay-card-study.csv" ] }, "sets": [ { "set_id": "p_detection_date", "label": "Phrase \"Detection Date\"", "kind": "phrase", "origin": "w1", "windows": 48, "windows_full": 2, "windows_sample": 46, "windows_count_only": 0, "exact_total": 311983, "n_fetched": 31105, "note": "Whole-phrase search; almost all hits are automated relay and feed cards." }, { "set_id": "p_compromised_data", "label": "Phrase \"Compromised data\"", "kind": "phrase", "origin": "w1", "windows": 48, "windows_full": 47, "windows_sample": 0, "windows_count_only": 1, "exact_total": 2088, "n_fetched": 2087, "note": "Forum share template phrase." }, { "set_id": "p_database_leak", "label": "Phrase \"database leak\"", "kind": "phrase", "origin": "w1", "windows": 48, "windows_full": 48, "windows_sample": 0, "windows_count_only": 0, "exact_total": 2958, "n_fetched": 2958, "note": "Whole-phrase search." }, { "set_id": "p_leaked_database", "label": "Phrase \"leaked database\"", "kind": "phrase", "origin": "w1", "windows": 48, "windows_full": 46, "windows_sample": 2, "windows_count_only": 0, "exact_total": 8623, "n_fetched": 5152, "note": "Whole-phrase search; the Sep-Oct volume is dominated by one cross-posted advert bot." }, { "set_id": "p_database_for_sale", "label": "Phrase \"database for sale\"", "kind": "phrase", "origin": "w1", "windows": 48, "windows_full": 41, "windows_sample": 0, "windows_count_only": 7, "exact_total": 143, "n_fetched": 143, "note": "Whole-phrase search; small." }, { "set_id": "k_data_breach", "label": "Keyword \"data breach\"", "kind": "keyword", "origin": "reused", "windows": 48, "windows_full": 47, "windows_sample": 1, "windows_count_only": 0, "exact_total": 9409, "n_fetched": 8654, "note": "Headline pool for news / first-hand composition." }, { "set_id": "k_breachforums", "label": "Breach-forum ecosystem keyword", "kind": "keyword", "origin": "reused", "windows": 48, "windows_full": 48, "windows_sample": 0, "windows_count_only": 0, "exact_total": 3055, "n_fetched": 3037, "note": "Ecosystem keyword; forum-heavy." }, { "set_id": "c_data_breach", "label": "Classifier label Data Breach", "kind": "class", "origin": "reused", "windows": 48, "windows_full": 7, "windows_sample": 23, "windows_count_only": 18, "exact_total": 24437, "n_fetched": 3042, "note": "Label exists Jan-Jun only. Text pool only." }, { "set_id": "c_database_sharing", "label": "Classifier label Database Sharing", "kind": "class", "origin": "reused", "windows": 48, "windows_full": 4, "windows_sample": 26, "windows_count_only": 18, "exact_total": 308193, "n_fetched": 3252, "note": "Label Jan-Jun; collapses from July. Text pool only." }, { "set_id": "c_data_leak", "label": "Classifier label Data Leak", "kind": "class", "origin": "reused", "windows": 48, "windows_full": 0, "windows_sample": 27, "windows_count_only": 21, "exact_total": 576224, "n_fetched": 2677, "note": "Label exists from May only. Text pool only." }, { "set_id": "c_pii", "label": "Classifier label PII", "kind": "class", "origin": "reused", "windows": 48, "windows_full": 4, "windows_sample": 26, "windows_count_only": 18, "exact_total": 482696, "n_fetched": 2765, "note": "Text pool only." }, { "set_id": "c_pii_kyc", "label": "Classifier label PII / KYC", "kind": "class", "origin": "reused", "windows": 48, "windows_full": 4, "windows_sample": 26, "windows_count_only": 18, "exact_total": 596937, "n_fetched": 2672, "note": "Text pool only." } ], "counting_units": [ { "unit": "windows", "count": 576, "definition": "12 query sets x 48 windows of at most 7 days, inside one month.", "source": "retrieval-windows.csv" }, { "unit": "unique_posts_fetched", "count": 64425, "definition": "Distinct Blackhole post ids across all fetched windows (a post in several sets counts once).", "source": "data/README.md" }, { "unit": "k_data_breach_exact_total", "count": 9409, "definition": "Posts matching the keyword \"data breach\", API total, Jan-27 Oct.", "source": "retrieval-windows.csv" }, { "unit": "k_data_breach_fetched", "count": 8654, "definition": "Posts fetched for the keyword; the 22-28 January window is a 100-post sample of 734.", "source": "retrieval-windows.csv" }, { "unit": "detection_date_exact_total", "count": 311983, "definition": "Posts containing the phrase \"Detection Date\".", "source": "retrieval-windows.csv" }, { "unit": "detection_date_fetched", "count": 31105, "definition": "Fetched posts used to estimate the composition.", "source": "data/README.md" }, { "unit": "relay_cards_march_full_week", "count": 6539, "definition": "Leak-monitor relay cards in the full week 8-14 March (exact).", "source": "evidence/checks/results.json B.march_full_week.n_cards" }, { "unit": "relay_cards_with_claim_key", "count": 6479, "definition": "Of those, cards whose Content label is long enough to get a claim key.", "source": "data/README.md" }, { "unit": "relay_distinct_claim_keys", "count": 5569, "definition": "Distinct claim keys among those cards (about 1.16 cards per key; one relay channel).", "source": "data/README.md" }, { "unit": "forum_share_pool_post_ids", "count": 1967, "definition": "Kept forum-share posts in the full windows of three forum-oriented sets (unique ids).", "source": "evidence/catalog/results.json" }, { "unit": "forum_share_distinct_claim_keys", "count": 1098, "definition": "Distinct claim keys in that pool.", "source": "evidence/catalog/results.json" }, { "unit": "forum_share_claim_level_posts", "count": 1124, "definition": "One post per claim key plus posts without a key: the claim-level denominator of the field and age charts.", "source": "evidence/catalog/results.json" }, { "unit": "w2_labelled_posts", "count": 260, "definition": "Posts labelled by the AI reader (validation).", "source": "validation/README.md" }, { "unit": "relay_cards_read", "count": 200, "definition": "Relay cards read for the content study.", "source": "evidence/checks/results.json" }, { "unit": "catalogue_records", "count": 44, "definition": "Selected evidence records DB-E001..; not incidents, sellers or victims.", "source": "evidence/catalog/catalog.json" } ], "blackhole_calls": { "attempts": 1124, "failures": 42 }, "limitations": [ "Counts are Blackhole-collected posts, Telegram-dominated. A post is not an incident, a victim, a seller, an actor or a transaction; a post ID is a source record ID.", "No statement is made that the dark web, forums or data breaches grew or shrank. Post volumes depend on what Blackhole collected.", "Forum post dates are partly day/month swapped (933 of 7,133 forum posts detectably, 13.1%; a further share cannot be verified). No forum monthly series is published; period-level shares and Telegram-only monthly ranges are the only time views.", "Classifier labels changed around May-July 2026 (a taxonomy break). Class sets are used only inside their own label period or as text pools; no trend across May-July.", "All reading, labelling and parsing was done by AI agents (Claude Opus 5.5, checked by Codex Astra): one AI reader for the 260-post validation sample, one for the evidence catalogue. Intervals describe sampling error, not reader error. Brandefense analysts approved the findings.", "Sampled windows (about 100 posts for reused pools, about 500 for the Detection Date phrase) carry sampling error; full windows carry none.", "Data age, size and field lists are what a poster states. Nothing was verified; a stated size can differ from the real file by a large factor.", "No prices are published as averages or market levels. No price amounts appear in any file.", "Windows are keyed on the recorded post date; the corpus ingests late (20-30% of posts arrive in a later month), so a re-pull before mid-November can change totals.", "Single-organisation examples in the catalogue are paraphrased and coarsened: month only, generic sector, sizes as orders of magnitude, no region next to a sector and size." ], "assets": { "manifest": "data-breach-data.json", "windows_csv": "retrieval-windows.csv", "sets_csv": "observed-records.csv", "units_csv": "counting-units.csv", "dictionary": "data-dictionary.html", "methodology": "methodology.html", "validation_html": "validation.html", "validation_json": "validation.json", "catalogue": [ "evidence-catalogue.html", "evidence-catalogue.json", "evidence-catalogue.csv" ], "press": "press-kit.html", "license": "license.html", "charts": [ { "id": "chart-field-mix", "svg": "chart-field-mix.svg", "png": "chart-field-mix.png", "csv": "chart-field-mix.csv" }, { "id": "chart-data-age", "svg": "chart-data-age.svg", "png": "chart-data-age.png", "csv": "chart-data-age.csv" }, { "id": "chart-k-data-breach-composition", "svg": "chart-k-data-breach-composition.svg", "png": "chart-k-data-breach-composition.png", "csv": "chart-k-data-breach-composition.csv" }, { "id": "chart-relay-card-mix", "svg": "chart-relay-card-mix.svg", "png": "chart-relay-card-mix.png", "csv": "chart-relay-card-mix.csv" }, { "id": "chart-detection-date-composition", "svg": "chart-detection-date-composition.svg", "png": "chart-detection-date-composition.png", "csv": "chart-detection-date-composition.csv" }, { "id": "chart-sale-terms-by-template", "svg": "chart-sale-terms-by-template.svg", "png": "chart-sale-terms-by-template.png", "csv": "chart-sale-terms-by-template.csv" } ], "social": [ "social-cover.png", "social-news-share.png", "social-data-age.png", "social-relay-cards.png" ] }, "ai_disclosure": { "byline": "Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.", "method_box": "**Why AI agents.** Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone. Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed. Brandefense analysts reviewed and approved the findings.", "source": "ops/data/cr2026/disclosure.md" }, "license": "CC BY 4.0 for original aggregates, charts and editorial paraphrases; raw source content is excluded.", "attribution": "Source: Brandefense Research Team, Data Breach and Leaks Research 2026, v1.0. Data: Brandefense Blackhole, 1 Jan–27 Oct 2026. Counts are collected posts, not incidents, victims or sellers." }