Alleged Adidas & ICFES Leaks, Belgian Banking Sale, PayPal Recruitment & 7.2M Card Listing

SOCRadar’s Dark Web Team identified several new underground posts this week, including an alleged Adidas customer data leak discussion, a large credit card dataset advertised for sale, and a recruitment-style post claiming access to PayPal’s Classic API. Additional listings referenced an alleged Belgian banking-related data sale tied to BESOX, and a large-scale ICFES data leak claim impacting Colombia.

Receive a Free Dark Web Report for Your Organization:

Alleged Database of Adidas is Leaked

SOCRadar Dark Web Team detected a threat actor post on a dark web forum referencing an alleged incident involving Adidas customer data.

According to the post, the claimed exposure was linked to an unauthorized external party accessing information via a third-party customer service provider, with the compromise described as primarily customer contact data connected to help desk interactions. The listing also repeats that passwords and payment card data were not compromised, positioning the value of the exposure around identity and contact-based targeting rather than direct financial theft.

Alleged 7M Credit Cards are on Sale

SOCRadar Dark Web Team detected a threat actor post on a dark web forum advertising an alleged credit card dataset containing 7,256,535 entries.

The seller claims the data was collected in early 2025 and states the cards do not include CVV, while marketing the dataset for use cases where CVV checks may not be required. The advertisement lists a price of $3,000, notes that payment is cryptocurrency-only, and promotes escrow with both “plain” and “cleaned” versions provided in a single archive.

New Recruitment Post is Detected for PayPal Classic API

SOCRadar Dark Web Team detected a threat actor post on a dark web forum advertising a recruitment-style arrangement tied to PayPal Classic API access.

According to the threat actor, they can process transfers via the Classic API and are seeking “serious partners” for drop arrangements with a percentage split. The post also emphasizes direct private messaging, claims escrow is accepted, and discourages “time wasters and scammers,” which is consistent with operational recruiting patterns seen in illicit financial ecosystems.

The Alleged Data of Belgian Banks are on Sale

SOCRadar Dark Web Team detected a threat actor post on a dark web forum advertising an alleged Belgian banking-related dataset connected to BESOX, described as a Belgian finance company.

The listing claims BESOX oversees roughly 1,500 companies and had access to each company’s banking information and owner details. The actor references data elements such as IBAN, BIC, and “social” identifiers, and includes preview material while directing interested parties to communicate via Telegram for more information.

The Alleged Database of ICFES is Leaked

SOCRadar Dark Web Team detected a threat actor post on a dark web forum claiming a large-scale leak linked to ICFES, advertised as a 100GB data release.

According to the post, the actor framed the leak as a protest action and claimed the dataset contains information related to more than 30 million Colombians. The listing included retrieval instructions using zstd and a shared download link, indicating an intent to distribute rather than restrict access through a paid sale model.

Powered by DarkMirror™

Gaining visibility into deep and dark web threats can be extremely useful from an actionable threat intelligence and digital risk protection perspective. However, monitoring all sources is simply not feasible, which can be time-consuming and challenging. One click-by-mistake can result in malware bot infection. To tackle these challenges, SOCRadar’s DarkMirror™ screen empowers your SOC team to follow up with the latest posts of threat actors and groups filtered by the targeted country or industry.