Ukraine’s SMIDA (ARIFRU) disclosure infrastructure became the subject of underground forum marketing alleging roughly 327 000 administrative credentials. BreachHistory stresses the row tracks criminal advertising, not a confirmed government breach bulletin, and may intersect older stealer composites.
Canonical record: Ukraine SMIDA 2026 credential claim on BreachHistory.
Sources: SMIDA about page, Daily Dark Web OSINT hub (attribution context)