🇮🇱 🚨 ISRAEL: THREAT ACTOR CLAIMS TO SELL 4.5TB OF MINISTRY OF DEFENSE, MOSSAD AND IDF DATA A threat actor using the name "UNC6783" claims to be selling about 4.5TB of data it says comes from Israeli defense and intelligence bodies. The only sale terms given are "Price? Negotiate with me!" The claimed breakdown: * Israel Ministry of Defense: 2.5TB (claimed) * Mossad: 1TB (claimed) * Israel Defense Forces (IDF): 1TB (claimed) The only proof shared is a screenshot of directory listings. No sample files, record counts or forum listing were provided. Earlier this month, an actor linked to the same alias advertised a "4.5TB" Israeli military cache on an underground forum under different labels (Israel Aerospace Industries, Rafael and the IDF), and separately claimed a ~5TB Israeli Ministry of Defense dataset. Forum users questioned the samples in that earlier listing. The claim has not been independently verified, and we found no official confirmation of any breach. ⚠️ Analyst Note: Anyone can use the UNC6783 name, and nothing here ties this post to the group Google Threat Intelligence tracks under that designation. Sale claims about Israeli defense and intelligence agencies are often exaggerated or recycled, and this one reuses the same 4.5TB figure as the earlier listing with new labels, which points to repackaging rather than a fresh intrusion. Directory listings alone are not proof of access or of what the files contain. We assess this as an unverified threat-actor claim, NOT confirmation of a breach of the Israeli Ministry of Defense, Mossad or the IDF. If any of it is authentic, it could feed influence operations, targeting of personnel and defense-themed phishing. #DDW #DarkWeb #Israel #Mossad #IDF #UNC6783 #ThreatIntelligence #CyberSecurity

🇮🇱 🚨 ISRAEL: HACKTIVISTS CLAIM THEY HACKED THE PERSONAL PHONE OF SARA NETANYAHU A pro-Jordanian hacktivist group claims it hacked the personal phone of Sara Netanyahu, wife of Israeli Prime Minister Benjamin Netanyahu, and has started leaking material from it. The group claims: * Access to private data of Sara Netanyahu, the Prime Minister and their family * "Confidential documents" from the Prime Minister's Office * Samples have been posted, with the group saying it is revealing only "a very small part" of the data * The leak follows the same group's claim yesterday against Netanyahu's son Avner The claim has not been independently verified, and neither the Prime Minister's Office nor Israeli authorities have commented. ⚠️ Analyst Note: The group published only a few samples and no proof that any material comes from the Prime Minister's Office. Hack-and-leak campaigns against Israeli leaders' families have often mixed real data with recycled or fabricated content, and the timing during Israel's election campaign points to an influence operation as much as a breach. We assess this as an unverified hacktivist claim, NOT a confirmed compromise. If authentic, the data could expose people close to the Prime Minister to phishing, impersonation and targeting. #DDW #DarkWeb #Israel #Hacktivism #Netanyahu #DataLeak #ThreatIntelligence #CyberSecurity

🇺🇸 🇳🇱 🇧🇪 🚨 UPDATE: AHOLD DELHAIZE CONFIRMS "MALICIOUS ACTIONS" BEHIND CYBER INCIDENT, FILES POLICE REPORT Follow-up to our earlier posts on the Ahold Delhaize cybersecurity incident. In an Oct 19, 2026 update, the company says its investigation confirmed the suspicious activity in its IT infrastructure "resulted from the malicious actions of others." What the company says (Oct 19): • Filed a formal police report with the Dutch police today; notified the Dutch NCSC within 24 hours of detection • Taking websites and apps offline affected most of its brands across Europe and the US; stores stayed open • Albert Heijn website and app are back; home deliveries expected to resume Friday, Oct 23 • Ahold Delhaize USA e-commerce (Food Lion, Stop & Shop and others) expected back "in the coming days"; Belgium e-commerce fully restored • "No evidence at this moment" that sensitive customer, associate or partner data was taken ⚠️ Analyst Note: The company still has not named the attack type, a threat actor or whether a ransom was involved, and no group has publicly claimed it. Confirming malicious actors plus a police report moves this from a precautionary shutdown to a confirmed attack. Expect phishing that impersonates these grocery brands about refunds, cancelled orders or loyalty points. Source (official): newsroom.aholddelhaize.com/a… #DDW #DarkWeb #AholdDelhaize #AlbertHeijn #FoodLion #StopAndShop #Retail #CyberAttack #CyberSecurity

🇳🇱 🚨 NETHERLANDS: PHILIPS ALLEGEDLY BREACHED, 13.5GB OF DATA LEAKED ON HACKER FORUM A threat actor calling itself "Z-Union" has published a 13.5GB dataset it claims was taken from Koninklijke Philips N.V., the Dutch health technology giant, and is offering it for free download. What we know so far: * Claimed size: 13.5GB * Shared openly as a downloadable dump, not offered for sale * The actor has not described the contents, so it is unclear whether the files include corporate documents, customer records or product data The claim has not been independently verified, and Philips has not publicly confirmed a breach. ⚠️ Analyst Note: Philips makes medical devices and health systems used by hospitals worldwide, so any real exposure of internal files could matter well beyond the company, from GDPR scrutiny to product and supply-chain risk. Until the dataset is examined, treat it as an unverified claim; recycled or third-party data is often relabeled with a big brand name. #DDW #DarkWeb #Netherlands #Philips #DataBreach #ThreatIntelligence

🇳🇱 🚨 NETHERLANDS: THREAT ACTOR CLAIMS TO SELL PICNIC ONLINE SUPERMARKET DATABASE AND SOURCE CODE A threat actor on an underground forum has posted a sale listing for data allegedly taken from Picnic, the online supermarket and grocery delivery service operating in the Netherlands. According to the listing, the offer includes: * Picnic's full database * Picnic's full source code No record count, sample or price was visible in the listing. The claim has not been independently verified. ⚠️ Analyst Note: Picnic delivers groceries to homes, so a real customer database would likely hold names, home addresses, phone numbers and order history, which is ideal material for delivery-themed phishing and fraud. Leaked source code could also help attackers find flaws in the app. With no sample shown, treat this as an early claim. Unverified threat-actor claim, NOT confirmation of a compromise of Picnic systems. Source: this is for subscribers only. Subscribe: xitter.cf/DailyDarkWeb/creator-s… #DDW #DarkWeb #Netherlands #Picnic #Ecommerce #Retail #DataBreach #ThreatIntelligence