Massive Data Leaks Exposed on Dark Web Amid Ransomware Surge

The420.In

Massive Data Leaks Exposed on Dark Web Amid Ransomware Surge

First seen 19 Oct 2026, 04:50 UTC • •51.9

Article Content

1 / 3

Browse articles

ThreatCluster •October 19, 2026 at 05:49 UTC

•Three major data leaks reported on the dark web in five days.
•Involved sensitive information, including driver's licenses and identity documents.
•Ransomware groups Qilin and Rhysida are linked to the incidents.

In a recent surge of cyber incidents, three significant data leaks occurred on the dark web within five days, affecting various organizations. The leaks involved sensitive information, including driver's license data and stolen identity documents, linked to the Qilin and Rhysida ransomware groups. The incidents highlight the ongoing threat posed by double extortion ransomware tactics, where attackers not only encrypt data but also threaten to leak it. Organizations are urged to enhance their monitoring of dark web activities to mitigate risks associated with credential exposure and identity theft. Current investigations are ongoing, with law enforcement agencies focusing on tracing the origins of these leaks. The situation remains fluid as more data may surface in the coming days.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-16

Three data leaks reported

Significant data leaks involving sensitive information occurred, linked to ransomware groups.

More articles in this cluster (2)

Threat Graph

9 entities, 14 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (4)

Data Breach
Phishing
Ransomware
T1041 - Exfiltration Over C2 Channel

Organization (2)

ATF
Berlin Administration

Threat Actor (2)

Qilin Ransomware
Rhysida Ransomware

Tool (1)

Phishing Kits

Relationships

Qilin Ransomware uses Phishing Kits
Rhysida Ransomware uses Phishing Kits
Qilin Ransomware uses Data Breach
Qilin Ransomware uses Phishing
Qilin Ransomware uses Ransomware
Qilin Ransomware uses T1041 - Exfiltration Over C2 Channel
Rhysida Ransomware uses Data Breach
Rhysida Ransomware uses Phishing
Rhysida Ransomware uses Ransomware
Rhysida Ransomware uses T1041 - Exfiltration Over C2 Channel
Qilin Ransomware targets ATF
Qilin Ransomware targets Berlin Administration
Rhysida Ransomware targets ATF
Rhysida Ransomware targets Berlin Administration

Following this threat?

Track Qilin Ransomware and ATF in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What types of data were leaked?

The leaks involved sensitive information such as driver's license data and stolen identity documents.

Which ransomware groups are involved?

The incidents are linked to the Qilin and Rhysida ransomware groups.

What should organizations do to protect themselves?

Organizations should enhance their monitoring of dark web activities and implement strong identity verification processes.

Continue Reading

Ampath Laboratories Confirms Cyberattack, Disputes Claims of 80 Million Records Compromised Ampath Laboratories, a major South African pathology lab, confirmed a cyber incident detected on October 2, 2026, which reportedly involved unauthorized access to its IT environment. The threat actor, ByteToBreach, claimed to have exfiltrated data from at least 10 databases, including 80 million records, but Ampath…

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…