Tel Aviv based marketing platform hit with a ransomware attack.

A total of 10 breach events were found and analysed resulting in 12,009,525 exposed accounts containing a total of 12 different data types of personal datum . The breaches found publicly and freely available included Strip Chat, Omaze, Ministry of Corporate Affairs, Government of India, Rostelecom and preen.me. Sign in to view the full library of breach events which includes, where available, reference articles relating to each breach.

Data Breach Analysis

Among the most high-profile of these breaches was Strip Chat, a widely known adult live-streaming service. Breaches of adult content platforms carry a unique severity due to the sensitive nature of user behaviour, often leading to reputational damage, blackmail risk, or social stigma. For many users, even minimal identifying information, such as usernames, login times, or payment logs, can lead to significant harm.

Omaze, a charity platform known for high-profile fundraising sweepstakes and celebrity-backed campaigns, was also part of this breach cohort. Given that users on Omaze often provide personal details to enter prize draws or donate, a data exposure here affects not only individual privacy but also undermines trust in digital philanthropy.

A particularly concerning inclusion in this set is the Ministry of Corporate Affairs (MCA), Government of India. This breach implies a government database was exposed, either directly or through a third-party platform. Data associated with government departments often includes national IDs, registration information, or professional details, making this breach especially impactful for Indian citizens and corporate entities.

Rostelecom, one of Russia’s largest telecom operators, also featured in the breach list. The presence of a telecom provider significantly elevates the exposure risk, as such services are closely tied to real-world identity, device information, and communication logs. The trust users place in ISPs for secure data handling is fundamental, and any compromise raises deep national security and personal privacy concerns.

Finally, preen.me, a social marketing and influencer engagement platform, represents the expanding digital perimeter that includes micro-data on behaviour, preferences, and brand interaction. Breaches in such platforms often compromise linked social profiles, campaign analytics, and possibly private influencer communications.

The public availability of the exposed datasets amplifies the long-term risk. Once user data is indexed or mirrored across forums, search engines, or data marketplaces, remediation becomes significantly harder. Individuals impacted by these breaches may continue to suffer consequences years after the initial exposure.

This breach group reinforces a core challenge of the digital era: data sprawl combined with weak security practices leads to recurring exposure, regardless of organisation size or intent. Whether it's an adult content viewer, a charitable donor, a telecom subscriber, or a government stakeholder, the consequences of poor data protection are universal.

As always, these incidents underscore the importance of ongoing breach detection, transparency in disclosure, and robust incident response. While these 10 breaches affected over 12 million accounts, the damage goes beyond numbers, it touches deeply on trust, privacy, and the responsibility organisations hold toward their users.

Spotlight

Another week and another set of leaks. Whilst we've not seen household company names, there is a constant stream of data breaches coming out of the cyber sphere at the moment.

The first breach we’re going to talk about today is a a fundraising platform, it's a large platform which raises money for a range of charity's. Unfortunately for them two large SQL databases with their users appeared on a hacking forum. There's been no comment from the company yet, no doubt their 'security incident response plan' is in full swing (wink). Over two Million email address’s, hashed passwords and physical address’s are just several of the datasets a member of the team discovered after inspecting the data.

A data breach which is doing the rounds is a Tel Aviv based marketing platform that connects "social media influencers" to big company names and brands. The company was hit with a ransomware attack in mid-June of 2020, the data was originally for sale on the dark web and now has obviously served its purpose to the ransomware gang in question as it has been dumped online. The data contained a variety of data types, ranging from biometric data, such as eye colour, to a list of all the social media platforms used by the influencers, as well as their email addresses.

Finally, a member of the team brought to my attention a website called FinSuite that had been breached and threat actors are currently selling their database. FinSuite says they offer business solutions for IFA, RIA, and stock brokers. A member of the team did pick up a free sample of the data, and after quick analysis, some of the data sets which stood out to us were partial credit card information such as account number and bank name, as well as physical address and dates of birth.