2026 Speero — UNC2030 dump claim; ~1M users + password/reset tokens (unverified)
Data compromised
Per Dark Web Informer (unverified): ~1,000,034 user rows across 83 CSV tables / 11GB — names, emails, phones, password field, email verification tokens, password-reset OTPs, account restoration tokens, push tokens, addresses, wallet balances/transactions, orders/invoices, lifetime spend/margin
Technical writeup
Unverified criminal-forum sale claim — August 21, 2026 (Dark Web Informer). New forum account UNC2030 advertised an 11GB / 83-table Speero (speero.net) dump citing ~1,000,034 user rows with password fields plus email-verification, password-reset OTP, and account-restoration token columns that could enable account takeover if unexpired; wallet balances and order history also claimed. Free user-table sample posted. Speero had not publicly confirmed at indexing. recordsAffected 1000034 = actor user-row count (unverified).
Root cause
Unverified forum sale — new actor UNC2030 claims full Speero (speero.net) database dump with live auth/reset tokens