Dark web monitoring for your company and your third parties
Sydney, Australia
Joined November 2022
- Tweets1K
- Following2
- Followers236
- Likes8K
Pinned Tweet
We've redesigned our entire UI from the ground up.
Because detecting data leaks should be easy.
AI analyses each alert.
Categorises it, writes the description.
Automatically closes false positives.
An analyst only needs 2 clicks to double check the finding and resolve it.
The University of New Mexico and its UNM Health system, a US public university and hospital network, have been listed on a dark web forum.
The actor claims access to 36,000 machines across the campus and hospital networks, including every student and employee record with Social Security numbers, HR and payroll, internal emails and Cerner patient-record rosters. The data is for sale, and the actor invites the university to buy it back along with a decryption key.
Credibility: 3/5. Detailed claim from an established actor, but no data sample; not independently verified.
Cambodia's National Employment Agency, a government job-matching service, has been listed on a dark web forum.
The actor claims 25,885 CVs, 8,185 employer records and the server's SSH keys and credentials, taken in October 2026, and has released it for free.
Credibility: 5/5. Sample fits the agency; not independently verified.
Shas, an Israeli political party, has been listed on a dark web forum.
The actor claims a 101 MB dump from the party's central BI server, including 197,815 rows of citizen ID numbers, phone numbers and predictive voting scores for Petah Tikva, plus phone numbers of mayors and ministers, and has posted a free download link.
The Madrid Football Federation (RFFM), Spain's regional football body, is now being offered for sale on a dark web forum.
Two days earlier, the actor demanded a $30,000 ransom within 48 hours. The full database is now listed at $1,000, and the actor claims it holds player and staff ID documents, passports, medical clearance certificates, home addresses and transfer histories.
American Family Insurance, a US insurer, has been listed on a dark web forum.
The actor claims more than 150 GB, including over 70,000 customer insurance claims, policy and work-order records, 21,000 staff directory accounts and a list of 2,500 Azure machines, and has released it as a free download.
Merck & Co., a US pharmaceutical company, has been listed on a dark web forum.
The actor claims more than 180 GB taken from services the company uses, including staff and client lists, contracts with partners, internal emails, pharmaceutical test data, Teams recordings and a smaller amount of patient information, and has released it as a free download.
Cambodia's National Employment Agency, a government job-matching service, has been listed on a dark web forum.
The actor claims 25,885 CVs, 8,185 employer records and the server's SSH keys and credentials, taken on 25 October 2026, and has released it for free.
Graphcom, a French digital signage company, has been listed on a dark web forum.
The actor claims source code, MSSQL backups, configuration files and hardcoded credentials taken in October 2026, says access is still live, and has released it all as a free download.
Rivanorth retweeted
Super excited to share that @rivanorthSec has been selected for the Buy Australian AI Partnership!
Buy Australian AI Partnership Program is a national program helping Australian AI companies strengthen procurement readiness, build enterprise connections and explore commercial opportunities.
Looking forward to refining Rivanorth Oko and helping more Aussie enterprises secure their data.
Massive thanks to @stoneandchalk and National AI Centre for selecting us!
Rivanorth retweeted
I just sent out the latest @rivanorthSec newsletter.
If you'd like to follow my work there and you haven't seen any recent updates, that's because we're moving away from social media as we know it and into interest media.
Where you only see things you've shown interest in recently.
If you'd like to stay in the loop, subscribe here: rivanorth.com/newsletter
Don't worry I only send out 5 to 6 emails a year, so you won't get spammed.
Wondering if your company has been mentioned on the dark web?
Request your free trial and find out: rivanorth.com/free-trial
Rivanorth retweeted
Demos are boring.
I used to run them for far too long...
So I completely redesigned everything and just launched the new @rivanorthSec website.
And if you want to know if your data was leaked.
Now it's easier then ever to request your free trial.
Check it out at rivanorth.com/
Rivanorth retweeted
AI hacking random companies is just normal now.
Great to see Gemini catching up with its superior siblings.
I still remember the days when a simple port scan would get you in trouble, now fully compromising companies is ok.
I mean, it's AI...
AI or not, what I found really interesting in the article is this:
"Gemini found public information online and guessed credentials to access websites it thought were part of the test"
No matter if the attacker is human, AI or a mix, they will all choose the easiest path in.
If you want to check if any of your data is out there.
You can grab your free trial of @rivanorthSec Oko here: rivanorth.com/
Rivanorth retweeted
Detecting data leaks should be easy.
The previous UI/UX wasn't cutting it, so I redesigned @RivanorthSec Oko from the ground up.
AI analyses each alert.
Categorises it, writes the description, impact and remediation.
Automatically closes false positives.
An analyst only needs 2 clicks to double check the finding and resolve it.
Done.
A more complex finding that needs the whole team to collaborate on? That's now also supported.
And if you're feeling more adventurous AI agent support via MCP is also coming very soon.
Keen to give it a crack? Comment or DM me.
Rivanorth retweeted
I've been ramping up the amount of dark web forum posts that we are scanning and saving into @rivanorthSec Oko.
The goal is to have good historical data including screenshots of any potential data leaks that can help teams asses their own past exposures but also the vendors they are working with.
Good week this one with over 17,000 posts indexed.
Good week this one with over 17,000 dark web forum posts indexed.
The goal is to have good historical data including screenshots of any potential data leaks that can help teams asses their own past exposures but also the vendors they are working with.
