2026 Netim — dark-web sale claim (unverified); 16.5M-document Elasticsearch + source code alleged
Data compromised
Actor-claimed 16.5M-document Elasticsearch cluster (payments, domains, tickets, hosting, SSL, staff accounts), customer master records with password hashes and VAT details (dated to March 2024), SQL dumps, and complete source-code repositories with credentials—unverified
Technical writeup
Unverified dark-web sale claim — indexed June 30, 2026. Threat-intelligence monitoring reported actor lucy advertising a one-time $5,000 cryptocurrency sale of alleged Netim.com data: a 16.5 million-document Elasticsearch cluster, internal customer database dumps with password hashes through March 2024, billing/hosting SQL exports, and source-code repositories with configuration credentials. As a domain registrar, confirmed exposure would enable domain hijacking and cascading customer compromise; the listing is unverified and may include recycled material. Netim had not publicly addressed the claim at catalog time. BreachHistory indexes recordsAffected 0.
Root cause
Unverified dark-web sale listing by actor lucy claiming comprehensive Netim.com (French domain registrar/host) data—Netim had not confirmed at catalog time