SecBoard
Threat Intelligence

Leak Monitor

Was Ransomware- und Erpressergruppen auf ihren eigenen Seiten veröffentlichen — laufend eingesammelt und aufbereitet.

Stand 22.10.2026, 20:32

Behauptung des Angreifers, kein bestätigter Vorfall

Ein Eintrag auf einer Leak-Seite ist eine Veröffentlichung der Täter. Gruppen listen regelmäßig Organisationen, bei denen nie ein Vorfall stattfand, und einzelne Gruppen erfinden ihre Opferlisten vollständig. SecBoard gibt diese Einträge wieder, ohne sie zu bestätigen.

Einträge 24 h

42

Einträge 7 Tage

293

aktive Gruppen (30 T.)

97

Länder (30 T.)

75

dysphor1a

10 Einträge insgesamt

Zeitraum: 29.08.2026 – 06.09.2026

Veröffentlichungskanäle

  • Leak-Seite · DYSPHOR1A Ransomware Group · zuletzt nicht erreichbar

Kanäle laut RansomLook. Die Adressen der Leak-Seiten werden bewusst nicht angezeigt — sie führen direkt zu den erbeuteten Daten.

Medienecho

Keine Meldung im Bestand nennt diese Gruppe — sie arbeitet unbeachtet. Das ist der Regelfall: von 81 aktiven Gruppen haben 23 ein Medienecho.

Neueste Einträge

Filter zurücksetzen
dysphor1aRTAD GOV MMMM

Beschreibung der Täter

Leaked: New | Sector: Government / Transport | Country: 🇲🇲 Myanmar | Records: 1.08 GB — full databases dump | Road Transport Administration Department (RTAD) — official government portal providing public transport services, driving license issuance, vehicle registration, and safety regulations. Full databases dump total 1.08 GB. Victim domain [Link entfernt] | Leaked | RTAD GOV MM Leaked New Critical 🇲🇲 Myanmar ID_RTAD-GOV-MM | Detected 2026 | Target // Government / Transport Description Road Transport Administration Department (RTAD) — official government portal providing public transport services, driving license issuance, vehicle registration, and safety regulations. Full databases dump total 1.08 GB. Victim domain [Link entfernt] Infection Mechanism Compromised RTAD government databases exposing vehicle registration records, owner PII, NRC numbers, addresses, vehicle details, and insurance premium data via internal API responses. Notable Attack Full databases dump — 1.08 GB from the Road Transport Administration Department (RTAD) of Myanmar, including owner names, NRC numbers, addresses, vehicle registration, branch, and premium payment records. Example Compromised {"code":

Herkunft

dysphor1aCitizensPayMM

Beschreibung der Täter

Sector: Digital Wallet / Payment Platform | Country: 🇲🇲 Myanmar | Records: 30 GB | Countdown: 2d 12h 37m 53s | Citizens Pay (also known as CTZPay) is a mobile digital wallet and payment platform in Myanmar powered by Myanmar Citizens Bank (MCB) and Capital Connect Limited. Compromised agent user information — total data size 30 GB. Price range $7,000 to $25,000. Victim domain [Link entfernt] | CITIZENSPAY | CitizensPay Upcoming Critical 🇲🇲 Myanmar ID_CITIZENSPAY | Detected 2026 | Target // Digital Wallet / Payment Platform Description Citizens Pay (also known as CTZPay) is a mobile digital wallet and payment platform in Myanmar powered by Myanmar Citizens Bank (MCB) and Capital Connect Limited. Compromised agent user information — total data size 30 GB. Price range $7,000 to $25,000. Victim domain [Link entfernt] Infection Mechanism Exposed agent user info including business license, NRC pictures (front/back), selfie, shop pictures, and phone numbers from the CTZPay agent verification pipeline. Notable Attack Full agent user info dump from Citizens Pay (CTZPay) — 30 GB including KYC documents (NRC front/back), selfies, business license, shop pictures, and phone numbers. Example

Herkunft

dysphor1aMBT TelecomMM
telekommunikation

Beschreibung der Täter

For Sale: New | Sector: Telecommunications / ISP | Country: 🇲🇲 Myanmar | Records: 209,970 user records — full dump | Myanmar Broadband Telecom Co., Ltd. (MBT) is a leading fiber internet service provider and telecommunications network solutions company established in Myanmar in 2013. Full database compromise exposing 209,970 user records including PII, passwords, and device information. | For Sale | MBT Telecom For Sale Critical 🇲🇲 Myanmar ID_MBT-TELECOM | Detected 2026 | Target // Telecommunications / ISP Description Myanmar Broadband Telecom Co., Ltd. (MBT) is a leading fiber internet service provider and telecommunications network solutions company established in Myanmar in 2013. Full database compromise exposing 209,970 user records including PII, passwords, and device information. Infection Mechanism Compromised MBT customer database exposing user PII, passwords, device types, and account metadata from their FTTH, DIA, and enterprise VPN services. Notable Attack Full user dump of 209,970 MBT Telecom customer records including names, phone numbers, passwords, and device information. Example Compromised Full DB Access — 209,970 User Records id,name,phone,created_at,user_stat

Herkunft

dysphor1aYoma FleetMM

Beschreibung der Täter

Sector: Business / Vehicle Leasing | Country: 🇲🇲 Myanmar | Records: Orders, users, repayments, employees — full admin export | Yoma Fleet is a leading vehicle operating lease, rental, and financing company based in Yangon, Myanmar. The platform provides centralized administration and management for vehicle orders, employee financing, repayments, users, and employee records. Admin account access — need to contact on Telegram. | Leaked

Herkunft

dysphor1aAYUDHYA TH InsuranceTH
finanzen

Beschreibung der Täter

Sector: Financial / Insurance | Country: Thailand | Records: Internal batch-control system + admin credentials | Leaked data from AYUDHYA (TH Insurance / Allianz Thailand). Internal batch-control system used within the financial/transaction batch-processing ecosystem behind the Allianz customer-facing web platform. Includes admin credentials (TBH2CASH:AAbb1234). | Leaked

Herkunft

dysphor1aGUSTO College GLMSMM

Beschreibung der Täter

Sector: Education Sector | Country: 🇲🇲 Myanmar | Records: User account credentials | Compromised user accounts from GUSTO College's GLMS (Global Learning Management System). Exposed user credentials from the Moodle platform at gusto-education.com. | Leaked

Herkunft

dysphor1aJob Net .COM.MMMM

Beschreibung der Täter

Sector: Business | Country: Myanmar | Records: ~500++ user accounts and cv information | Normal Hunters operation compromising Job Net .COM.MM business data, exposing corporate information, user accounts, and business operations data. | Leaked

Herkunft

dysphor1aThe University of Delhi (DU)IN

Beschreibung der Täter

Sector: Education Sector | Country: 🇮🇳 India | Records: Student records with PII, academic data, and identification documents | The University of Delhi (DU) is a major public university in New Delhi, India, founded in 1922. It is one of India's most well-known universities, offering undergraduate, postgraduate, and doctoral programs across subjects like science, arts, commerce, law, and technology. | For Sale

Herkunft

dysphor1aIndonesian Police DatabaseID

Beschreibung der Täter

Sector: Government / Law Enforcement | Country: Indonesia | Records: 52,000 officer records + 4,000 facial photos | Database containing records of 52,000 Indonesian police officers including email addresses, phone numbers, first and last names, passwords, location details, and 4,000 facial photographs. | For Sale

Herkunft

dysphor1aNetim CompanyFR

Beschreibung der Täter

Sector: Business / Domain Registrar | Country: 🇫🇷 France | Records: Source code, IPs, payment databases, customer PII — full infrastructure | Netim is a French domain name registrar and web hosting provider. Full compromise of internal systems — source code, infrastructure IPs, payment processing databases, customer PII, and internal business data. | For Sale

Herkunft

Land und Branche liefern Ransomware.live und ThreatCluster (dort nur für die selbst erhobenen Einträge); sonst werden sie aus dem Eintragstext abgeleitet. Belegt bei 61 % der Einträge — die übrigen erscheinen ohne Land.

Quellen sind die Aggregatoren RansomLook, ThreatCluster und Ransomware.live (von ThreatCluster nur die selbst erhobenen Einträge). Melden mehrere dasselbe Opfer, steht es einmal da — mehrere Quellen heißt: mehrere haben dieselbe Behauptung gelesen, nicht: der Vorfall ist bestätigt. Die Zuordnung zur Gruppe stammt aus der Quelle, nicht aus einer eigenen Attribution durch SecBoard. Es werden ausschließlich Metadaten verarbeitet — keine erbeuteten Daten.