Italy RDWeb Access, GBCSA Data Sale, SCHUFA Claim, and FLY Firebase Exposure

SOCRadar Dark Web Team identified several new underground posts involving alleged initial access sales and large-scale data exposure. The findings include an alleged RDWeb access listing for an Italian cloud and IT services provider, a claimed GBCSA database sale, an alleged BullyPedex customer and payment dataset, a major SCHUFA credit data claim, and an alleged Firebase-related exposure affecting the Korean food-delivery platform FLY.

Receive a Free Dark Web Report for Your Organization:

Alleged Italian Cloud and IT Provider RDWeb Access is Detected

SOCRadar Dark Web Team detected a threat actor post auctioning alleged unauthorized access to an Italian cloud and IT services provider. The listing claimed the company has annual revenue under $5 million and that the access provides direct entry through RDWeb into a Windows Server environment.

According to the post, the server was described as running Windows SQL Server NT and supporting 10 users, with IDProtect and Sophos Endpoint Guard present in the environment. The auction started at $1,200, with a $100 step and a $2,000 blitz price.

For cloud and IT service providers, this type of access can carry risk beyond the initially affected organization. If valid, RDWeb access could support lateral movement, credential theft, ransomware deployment, or downstream compromise attempts against customer environments connected to the provider.

Alleged GBCSA Database Sale is Detected

SOCRadar Dark Web Team detected a post claiming compromise of the Green Building Council South Africa, with the actor advertising a database allegedly containing 500,000 records. The listing also claimed root access to several related domains and subdomains, including production and staging environments.

The advertised dataset reportedly includes names, email addresses, phone numbers, physical addresses, and demographic details. The actor priced the database at $500 and presented the sale as a limited opportunity, stating that only one message remained before access would be granted.

Alleged BullyPedex Customer Database Sale is Detected

SOCRadar Dark Web Team detected a post advertising an alleged BullyPedex.com database containing more than 280,000 records. The seller claimed the data was obtained in July 2026 and shared a preview showing customer-related fields such as email, address, balance, customer account, invoice settings, phone, subscriptions, and tax-related fields.

The sample appeared to include payment-related metadata, including references to Stripe payment objects, billing addresses, customer identifiers, and transaction details. The dataset was listed for $800, with escrow mentioned as an option.

Even without full card numbers, payment metadata can still be valuable to attackers. It can help build convincing phishing lures, impersonate billing support, target customers with refund or payment-failure scams, and enrich existing identity datasets with transaction context.

Alleged SCHUFA Credit Data Breach is Detected

SOCRadar Dark Web Team detected a post claiming to sell an alleged database from SCHUFA, Germany’s private credit information agency. The actor claimed the database contains 70 million records, with samples indicating names, dates of birth, addresses, credit scores, payment histories, bank names, and IBANs.

This claim is especially sensitive because credit agency data can combine identity, financial, and behavioral risk indicators in one profile. If the dataset is authentic, exposed IBANs and credit-related details could enable financial fraud, synthetic identity activity, and highly personalized phishing campaigns.

Alleged FLY Firebase Data Exposure is Detected

SOCRadar Dark Web Team detected a post claiming a major exposure involving the Korean food-delivery platform FLY. The actor claimed to have extracted 47.9 million records from a production backend due to an unauthenticated Firebase configuration with open read and write access.

The dataset was described as 46.6GB and included customer orders, GPS coordinates, apartment door codes, rider profiles, Korean Resident Registration Numbers, plaintext passwords, restaurant profiles, and live payment-gateway API keys. The actor claimed the extraction occurred between August 13 and August 14, 2026.

Powered by DarkMirror™

Gaining visibility into deep and dark web threats can be extremely useful from an actionable threat intelligence and digital risk protection perspective. However, monitoring all sources is simply not feasible, which can be time-consuming and challenging. One click-by-mistake can result in malware bot infection. To tackle these challenges, SOCRadar’s DarkMirror™ screen empowers your SOC team to follow up with the latest posts of threat actors and groups filtered by the targeted country or industry.