☑️ Weekly Darkweb – May Week 4, 2026

🔍 74M Records of Data from Japan’s National Personnel Authority for Sale

• On May 27, a post selling internal data from Japan’s National Personnel Authority was identified on the dark web hacking forum ‘BreachForums.’ (Price: USD 1,300)

✓ The National Personnel Authority is the Japanese government agency responsible for overseeing the national civil service system, including public servant recruitment, HR management, and salary administration

• The threat actor ‘Databasehooligan’ claimed to possess approximately 740,000 records containing government employee information, including personal salary, department, and financial data such as bank account and pension details.

• According to S2W’s user profiling tool, the actor has uploaded more than 10 data sale posts related to Asian countries over the past week, including a recent post targeting major Japanese telecommunications company ‘K’.

🔍 South Korean Publisher ‘M’ Customer Data Found on the Dark Web

• On May 27, a post claiming to sell customer data from South Korean textbook publishing company ‘M’ was uploaded to the dark web hacking forum ‘BreachForums.’ (Price: USD 1,400)

✓ Company ‘M’: A specialized textbook publisher that has exclusively published elementary Korean language textbooks for more than 70 years. The company’s annual revenue for 2025 was reported approximately USD 189 million.

• The threat actor ‘Databasehooligan’ claimed to have obtained customer personal information and purchase records, as well as encrypted passwords, password hints, password security scores, 2FA usage status, 2FA methods, last login IP addresses, persistent login tokens, and password reset tokens.

• Users without 2FA enabled may become primary targets, while even accounts protected with 2FA could potentially be compromised through the abuse of persistent login tokens to bypass authentication.

🔍 Customer Data of Taiwanese E-Commerce Company ‘P’ for Sale on Dark Web

• On May 27, a post claiming to see customer data from Taiwanese e-commerce platform ‘P’ was identified on the dark web hacking forum ‘BreachForums.’ (Price: USD 1,400)

✓ Company ‘P’: a major Taiwanese e-commerce company that reportedly recorded annual revenue of approximately USD 1.1 billion in 2025.

• The threat actor claimed to possess approximately 430,000 customer-related records, including contact information, customer inquiries, and order history data. As proof of the alleged breach, the actor also shared three URLs providing access to sample datasets.

*The full report is available upon request and for XARVIS subscribers.