INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Finaxis & HT Médica Compromised in Massive Data Breach Incident

| 2026-10-26 12:13 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
On October 26, 2026, a series of alleged data breaches were detected on the dark web. An alleged Finaxis.cloud database sale was advertised, involving 400GB of information reportedly obtained after management allegedly refused to meet ransom demands; this could facilitate financial fraud and targeted attacks against business partners. Another post claimed an alleged WoWInstaller historical database containing around 1.21 million records, including usernames, email addresses, and plaintext passwords, potentially exposing former users to credential stuffing and account takeover attempts if reused across other services. Additionally, a dark web post advertised an alleged MyHairCare Australia customer database with approximately 1,048,576 records, as well as an alleged HT Médica database containing 2.2 million records; these leaks could support phishing, impersonation, and social engineering attacks targeting students and educational personnel if verified.
Technical Mitigations AI-generated
• Patch Finaxis.cloud to address potential vulnerabilities in the payment processing platform, as a data breach could facilitate financial fraud and targeted attacks against business partners. • Monitor WoWInstaller for signs of credential stuffing or account takeover attempts due to historical database leaks containing plaintext passwords. • Block or hunt for records with recent login activity from alleged Moodle dataset exposure to prevent phishing, impersonation, and social engineering attacks targeting students and educational personnel.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
FIVE_EYES FIVE_EYES healthhealth
Incident Timeline
‎October 18, 2026
Threat actors are advertising a potentially authentic 2.2 million-record database associated with HT Médica, a Spanish healthcare provider specializing in diagnostic imaging.
industry Health
General Document Context
data_breach 1,048,576 records
The seller, identified as JSON09 , claimed the dataset contained 1,048,576 records obtained during an incident dated October 18, 2026.
data_breach 2.2 records
Alleged HT Médica Database Sale is Detected SOCRadar Dark Web Team detected a post advertising an alleged 2.2 million-record database associated with HT Médica , a Spanish healthcare provider specializing in diagnostic imaging.
organisation DNI
The advertised dataset reportedly contains first and last names, dates of birth, DNI identification numbers, email addresses, gender information, personal and work phone numbers, and physical addresses .
organisation DarkMirror
Powered by DarkMirror™ Gaining visibility into deep and dark web threats can be extremely useful from an actionable threat intelligence and digital risk protection perspective.
organisation SOC
To tackle these challenges, SOCRadar’s DarkMirror™ screen empowers your SOC team to follow up with the latest posts of threat actors and groups filtered by the targeted country or industry.
‎2026/10/26
SOCRadar Dark Web Team identified a dark web post advertising an alleged 400GB data breach involving Finaxis.cloud, a payment processing platform serving high-risk industries.
data_breach 2.2 records
Other posts advertised an alleged MyHairCare Australia customer database and an alleged HT Médica database containing 2.2 million records.
organisation Dark Web Team
SOCRadar Dark Web Team identified several underground posts, including an alleged Finaxis.cloud data sale involving 400GB of information , a resurfaced WoWInstaller database containing historical user credentials, and an alleged Argentine Moodle platform data leak.
data_breach 400 GB
SOCRadar Dark Web Team identified several underground posts, including an alleged Finaxis.cloud data sale involving 400GB of information , a resurfaced WoWInstaller database containing historical user credentials, and an alleged Argentine Moodle platform data leak.
Alleged Finaxis.cloud Data Breach is Advertised SOCRadar Dark Web Team detected a post advertising an alleged 400GB data breach involving Finaxis.cloud , a payment processing platform serving high-risk industries, including iGaming.
organisation Detected
Alleged Argentine Moodle Data Leak is Detected SOCRadar Dark Web Team detected a post claiming to expose user information from an Argentine educational platform using Moodle .
organisation Data Breach
Alleged Finaxis.cloud Data Breach is Advertised SOCRadar Dark Web Team detected a post advertising an alleged 400GB data breach involving Finaxis.cloud , a payment processing platform serving high-risk industries, including iGaming.
organisation Moodle
Finaxis, WoWInstaller, Moodle, MyHairCare & HT Médica Leaks.
organisation MyHairCare & HT Médica Leaks
Finaxis, WoWInstaller, Moodle, MyHairCare & HT Médica Leaks.
organisation MEC
The actor, operating under the alias Synq1xxs , shared sample records allegedly associated with an educational management system identified as MEC and claimed that a persistent issue within the Moodle service had enabled the exposure.
data_breach 1.21 records
The seller claimed the database originated from a breach dating back to approximately 2017 and contained around 1.21 million records after duplicate entries were removed.
Tactical Metrics
Metrics
data_breach
2,200,000
Records
Other posts advertised an alleged MyHairCare Australia customer database and an alleged HT Médica database containing 2.2 million records.
Alleged HT Médica Database Sale is Detected SOCRadar Dark Web Team detected a post advertising an alleged 2.2 million-record database associated with HT Médica , a Spanish healthcare provider specializing in diagnostic imaging.
Metrics
data_breach
400
Gb
SOCRadar Dark Web Team identified several underground posts, including an alleged Finaxis.cloud data sale involving 400GB of information , a resurfaced WoWInstaller database containing historical user credentials, and an alleged Argentine Moodle platform data leak.
Alleged Finaxis.cloud Data Breach is Advertised SOCRadar Dark Web Team detected a post advertising an alleged 400GB data breach involving Finaxis.cloud , a payment processing platform serving high-risk industries, including iGaming.
Metrics
data_breach
1,048,576
Records
The seller, identified as JSON09 , claimed the dataset contained 1,048,576 records obtained during an incident dated October 18, 2026.
Metrics
data_breach
1,210,000
Records
The seller claimed the database originated from a breach dating back to approximately 2017 and contained around 1.21 million records after duplicate entries were removed.
Intelligence Sources
SOCRadar CTI Blog 2026-10-26