Note

The September 2026 Dark Web Breach Incident Trend Report focuses on data breach cases and the sale of initial access credentials posted on the deep web and dark web forums. The report explicitly states that the accuracy of some of its content cannot be fully verified due to the nature of the sources.

Major Issue

• Data breaches and the trading of access credentials targeting government, public sector, defense, financial, healthcare, telecommunications, and manufacturing sectors worldwide were observed on a widespread basis.
• Certain threat actors claimed to have compromised personnel and internal systems at US government agencies and obtained sensitive data; they also continued to make claims of data breaches and issue public threats against companies in the consumer goods manufacturing, biotechnology and life sciences, and medical device sectors.
• Certain threat actors compromised DLS operated by rival cybercrime organizations and demanded ransom; those organizations, in turn, hinted at the possibility of further retaliation.
• In the government, public institutions, and defense sectors, numerous claims of data breaches were confirmed, including internal documents from US law enforcement and judicial agencies, classified military documents from the Middle East, classified military-related documents from South Asia, and data from systems under Central Asian government agencies.
• In the financial services sector, data and accounts related to virtual asset services, international money transfers, insurance, banking, and microfinance—as well as source code, VPNs, API keys, and online account access rights—were traded.
• In the healthcare and pharmaceutical sectors, data and access rights from pharmaceutical companies, pharmaceutical research institutions, pharmaceutical and healthcare companies, medical service providers, and digital healthcare companies were posted.
• In the Saudi Arabia region, numerous documents related to education, food and drug regulation, defense, and internal affairs administration were identified, along with customer data from private companies, VPN access rights, and access to database information.
• In South Korea, large-scale sales listings related to public institutions such as healthcare and social security agencies, telecommunications companies, and e-commerce firms appeared; a significant portion of these had not been independently verified, raising the possibility that they contained false data. However, some sample data was confirmed to match actual information.
• A specific data-leaking group disclosed data related to Korean medical institutions, pharmaceutical companies, and educational service providers, while domestic media reported on evidence of data theft targeting the financial services sector and the legal services sector.
• The sale of initial access credentials continued in various forms, including VPN, RDP, RMM, GitHub, RDWeb, and root access, and was cited as a preliminary step leading to ransomware attacks and data theft.
• In the AI sector, observations included source code from AI model developers and security firms, access rights to AI and generative AI infrastructure at global manufacturing companies, and attempts to trade accounts for generative AI services.
• The trading of access rights to OT systems, as well as driver’s licenses and ID card data, was also confirmed; analysts noted that this could lead to service disruptions and identity theft risks.

Conclusion

The key highlights of this month’s trends include ShinyHunters’ claims of a major data leak, the conflict with CL0P, attempts to leak data that target government agencies, defense organizations, and public institutions, and the global spread of initial access trading. In South Korea, posts were observed across the public sector, telecommunications, retail, healthcare, finance, and manufacturing; however, the large-scale figures related to NHIS, LG Uplus, and Coupang have not been verified and are highly likely to be false data. Organizations must maintain rigorous inspections and strengthen authentication for remote access methods such as VPNs, RDP, and RMM, as well as for source code repositories, retired employee account tokens, and partner accounts.