2026 ICAI — dark-web SQL dump claim (unverified); 8.3GB alleged
Data compromised
Actor-claimed personal details, database structures, and professional member records in an alleged 8.3GB unzipped SQL dump (256MB compressed), with data reportedly dating to 2018—no attested row count
Technical writeup
Unverified dark-web claim — first reported February 16, 2026. UpGuard and breach monitors described forum chatter offering an alleged full SQL dump of Institute of Chartered Accountants of India systems (~8.3GB unzipped, 256MB zipped) with legacy records reportedly dating to 2018. ICAI had not published a forensic victim count or formal member notification corroborating the dump at catalog time. By mid-2026, ICAI members reported McAfee and similar identity-monitoring warnings that member data appeared in breach compilations tied to icai.org, amplifying concern across India's chartered-accountancy profession without an attested company row total. BreachHistory indexes recordsAffected 0 pending ICAI or Indian regulator confirmation of scope.
Root cause
Unverified dark-web forum listing of alleged full SQL database dump from Institute of Chartered Accountants of India (icai.org)—ICAI had not confirmed scope at catalog time; McAfee identity alerts surfaced for members mid-2026