{
	"id": "5a1ac67c-831d-45ab-840e-67ab733f427a",
	"created_at": "2026-04-06T00:14:47.475009Z",
	"updated_at": "2026-04-10T03:25:21.630782Z",
	"deleted_at": null,
	"sha1_hash": "5da2e6d5c9cc46048cc33b8f819982ffe847196d",
	"title": "127 million user records from 8 companies put up for sale on the dark web",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 929735,
	"plain_text": "127 million user records from 8 companies put up for sale on the\r\ndark web\r\nBy Written by Catalin Cimpanu, ContributorContributor Feb. 14, 2019 at 1:03 p.m. PT\r\nArchived: 2026-04-05 16:43:06 UTC\r\nAn individual who earlier this week was selling 620 million user records stolen from 16 companies has now put\r\nup a second batch of hacked data totaling 127 million, originating from eight companies.\r\nThe data is currently being sold on Dream Market, a dark web marketplace where crooks sell an assortment of\r\nillegal products, such as user data, drugs, weapons, malware, and others.\r\nThe individual selling the data goes by the name of Gnosticplayers, and it's currently unclear if they're the\r\none/ones who hacked the 24 companies, or just a third-party who purchased the data from the real hacker and is\r\nnow re-selling it for a bigger profit.\r\nAccording to tech news site TechCrunch, who first reported this new batch of hacked accounts going for sale on\r\nDream Market, Gnosticplayers is asking for roughly four bitcoin, which is about $14,500 in fiat currency. Prices\r\nvary depending on the quality of the user data and the difficulty in cracking password hashes.\r\nThis second batch of hacked accounts includes data from the following companies:\r\nhttps://www.zdnet.com/article/127-million-user-records-from-8-companies-put-up-for-sale-on-the-dark-web/\r\nPage 1 of 5\n\nCompany\r\nDB\r\nsize\r\nBreach\r\ndate\r\nPrice Content\r\nGe.tt (file sharing\r\nservice)\r\n1.83\r\nMil\r\n2017/12 ฿0.16\r\nfirstname, lastname, password hash\r\n(SHA256), Facebook ID, referer\r\nIxigo (travel and hotel\r\nbooking)\r\n18\r\nMil\r\n2019/01/01 ฿0.262\r\npassword hashes (MD5), full name,\r\nFacebook URL, IP address, username,\r\nemail, and, for some users even the\r\npasseport ID number, passeport name etc\r\nRoll20.net (gaming)\r\n4\r\nMil\r\n2019/01/01 ฿0.0582\r\nname, email, passwords (bcrypt), nickname,\r\ngaming data, some redacted financial data,\r\nserver log data\r\nHouzz (interior design)\r\n57\r\nMil\r\n2018/07 ฿2.91\r\nemail, password (SHA256), registration\r\ndate, name\r\nCoinmama\r\n(cryptocurrency\r\nexchange)\r\n0.42\r\nMil\r\n2017/08/02 ฿0.3497\r\nemail, password (PHPASS), other\r\nunspecified\r\nYounow (live streaming)\r\n40\r\nMil\r\n2017/10 ฿0.131\r\nfull name, profile ID, IP addresses, email,\r\nFacebook email and ID, Instagram ID,\r\nGoogle ID, Twitter ID\r\nStrongHoldKingdoms\r\n(gaming)\r\n5\r\nMil\r\n2018/09 ฿0.291\r\nusername, email, password (HMAC-RIPEMD160), profile stats, gaming data,\r\nSteamID\r\nPetflow (pet food\r\ndelivery)\r\n1\r\nMil\r\n2017 ฿0.1777\r\nemail, username, password (MD5), other\r\nundisclosed data\r\nhttps://www.zdnet.com/article/127-million-user-records-from-8-companies-put-up-for-sale-on-the-dark-web/\r\nPage 2 of 5\n\nImage: ZDNet\r\nOf the companies listed above, Houzz had already come clean about its data breach last week. The other seven\r\ncompanies did not publicly reveal any security breaches before the publication of today's ads.\r\nThis new batch of stolen databases comes after earlier this week, the same Dream Market user was selling the\r\nfollowing user databases from 16 other companies:\r\nhttps://www.zdnet.com/article/127-million-user-records-from-8-companies-put-up-for-sale-on-the-dark-web/\r\nPage 3 of 5\n\nCompany\r\nDB\r\nsize\r\nBreach\r\ndate\r\nPrice Content\r\nDubsmash (video\r\nsharing)\r\n161.5\r\nMil\r\n2018/12 ฿0.549\r\nuser ID, password (SHA256), username,\r\nemail, language, country, more\r\n500px (image hosting)\r\n14.8\r\nMil\r\n2018/07 ฿0.217\r\nusername, email, password (MD5,\r\nSHA512, or bcrypt), first and last name,\r\nbirth date, gender, city, country\r\nEyeEm (image hosting)\r\n22.3\r\nMil\r\n2018/02 ฿0.289 email and password (SHA1)\r\n8fit (fitness app)\r\n20.1\r\nMil\r\n2018/07 ฿0.2025\r\nemail, password (bcrypt), country, country\r\ncode, Facebook token, Facebook profile\r\npicture, name, gender, and IP address\r\nFotolog (photo app) 16 Mil 2018/12 ฿0.52\r\nemail, password (SHA256), security\r\nquestion and answer, name, location,\r\nvarious profile data\r\nAnimoto (video editing\r\nservice)\r\n25.4\r\nMil\r\n2018 ฿0.318\r\nusername, password hash (256), email,\r\ncountry, full name, and date of birt\r\nMyHeritage (family\r\ngenealogy service)\r\n92 Mil 2017/10 ฿0.549\r\nemail, password hash (256), account\r\ncreation date\r\nMyFitnessPal\r\n(UnderArmor's fitness\r\napp)\r\n150\r\nMil\r\n2018/02 ฿0.289\r\nuser ID, username, email, password hash\r\n(SHA1) with a fixed salt, IP address\r\nArtsy (art sharing portal) 1 Mil 2018/04 ฿0.0289\r\nemail, name, IP addresses, location, and\r\npassword (SHA256)\r\nArmor Games (online\r\ngaming)\r\n11 Mil 2018/12 ฿0.2749\r\nusername, email, password (SHA256),\r\ndate of birth, gender, location, and profile\r\ndata\r\nBookmate (e-book and\r\naudiobook app)\r\n8 Mil 2018/07 ฿0.159\r\nusername, email, password (SHA512 or\r\nbcrypt), gender, date of birth, and profile\r\ndata\r\nCoffeeMeetsBagel\r\n(dating app)\r\n6 Mil\r\nlate 2017 to\r\nmid-2018\r\n฿0.13\r\nfull name, email, age, registration date,\r\nand gender\r\nDataCamp (coding\r\nplatform)\r\n0.7\r\nMil\r\n2018/12 ฿0.013\r\nemail, password (bcrypt), location, and\r\nprofile data\r\nhttps://www.zdnet.com/article/127-million-user-records-from-8-companies-put-up-for-sale-on-the-dark-web/\r\nPage 4 of 5\n\nHauteLook (online\r\nshopping)\r\n28 Mil 2018 ฿0.217 email, password (bcrypt), and name\r\nShareThis (social\r\nsharing widegt)\r\n41 Mil 2018/07 ฿0.217\r\nname, username, email, password (DES),\r\ngender, date of birth, and profile data\r\nWhitePages (online\r\nphone book)\r\n17.7\r\nMil\r\nlate 2017 ฿0.434 name, email, password (SHA1 or bcrypt)\r\nAnimoto, MyFitnessPal and MyHeritage previously disclosed breaches last year. DataCamp, 500px, Dubsmash,\r\nEyeEm, Artsy, 8fit, and CoffeeMeetsBagel confirmed this week that they've been breached as well, giving\r\ncredence to the seller's boast that this is real data and not just a scam.\r\nThese 16 databases are no longer available for sale now. Gnosticplayers said he took them down after buyers\r\ncomplained that a prolonged sale would eventually lead to some of these databases leaking online, and becoming\r\navailable to everyone.\r\nMore updates to follow as we're still looking at the data.\r\nData leaks: The most common sources\r\nMore data breach coverage:\r\nChinese company leaves Muslim-tracking facial recognition database exposed online\r\nHackers wipe US servers of email provider VFEmail\r\nDunkin' Donuts accounts compromised in 2nd credential stuffing attack in 3 months\r\nChina hacked Norway's Visma cloud software provider\r\nOnline casino group leaks information on 108 million bets, including user details\r\nAirbus data breach impacts employees in Europe\r\nMassive breach leaks 773 million email addresses, 21 million passwords CNET\r\nHackers turn to data theft and resale on the Dark Web for higher payouts TechRepublic\r\nSource: https://www.zdnet.com/article/127-million-user-records-from-8-companies-put-up-for-sale-on-the-dark-web/\r\nhttps://www.zdnet.com/article/127-million-user-records-from-8-companies-put-up-for-sale-on-the-dark-web/\r\nPage 5 of 5",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MISPGALAXY",
		"Malpedia",
		"ETDA"
	],
	"references": [
		"https://www.zdnet.com/article/127-million-user-records-from-8-companies-put-up-for-sale-on-the-dark-web/"
	],
	"report_names": [
		"127-million-user-records-from-8-companies-put-up-for-sale-on-the-dark-web"
	],
	"threat_actors": [
		{
			"id": "1609af91-e258-4058-9caa-59e7d171aecb",
			"created_at": "2022-10-25T16:07:24.491691Z",
			"updated_at": "2026-04-10T02:00:05.008935Z",
			"deleted_at": null,
			"main_name": "Gnosticplayers",
			"aliases": [],
			"source_name": "ETDA:Gnosticplayers",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "56d15cc7-f9c1-451f-bdde-8c283e3cf15b",
			"created_at": "2023-01-06T13:46:39.015288Z",
			"updated_at": "2026-04-10T02:00:03.181411Z",
			"deleted_at": null,
			"main_name": "Gnosticplayers",
			"aliases": [],
			"source_name": "MISPGALAXY:Gnosticplayers",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434487,
	"ts_updated_at": 1775791521,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/5da2e6d5c9cc46048cc33b8f819982ffe847196d.pdf",
		"text": "https://archive.orkl.eu/5da2e6d5c9cc46048cc33b8f819982ffe847196d.txt",
		"img": "https://archive.orkl.eu/5da2e6d5c9cc46048cc33b8f819982ffe847196d.jpg"
	}
}