Old Breaches Resold as New Corporate Data Leaks

Dark web data brokers are increasingly recycling old breach data and marketing it as fresh corporate leaks.

The activity, largely observed in Chinese-language cybercrime forums and Telegram channels, is creating confusion among organizations and diverting security resources toward investigating claims that often lack credibility.

Group-IB identified a surge in high-volume data advertisements targeting companies across multiple industries worldwide.

These posts frequently claim to offer hundreds of thousands or even millions of records allegedly stolen from recent breaches.

However, detailed analysis reveals that most of these datasets are not newly compromised data but instead compilations of previously leaked information, often mixed with fabricated or poorly generated entries.

The research highlights five prominent sources operating within Chinese-speaking underground ecosystems, including dark web forums such as Exchange Market, also known as Deepmix, and Chang’An Sleepless Night, along with Telegram-based brokers like Aiqianjin, Yiqun Data, and Phoenix Overseas Resources.

These platforms share similar operational patterns, including rapid posting frequency, structured advertisement formats, and limited transparency in user identities.

Exchange Market, active since 2013, differs from typical dark web forums by lacking user profiles and private messaging features.

Sellers are identified only by randomly assigned numeric IDs, and communication relies on public thread replies.

Chang’An Sleepless Night follows a comparable model, with anonymized usernames and restricted interaction capabilities, reinforcing the opaque nature of these ecosystems.

Telegram channels have also become a major distribution point for such data. Aiqianjin, for instance, amassed around 5,000 subscribers before ceasing operations in mid-2025, while newer actors like Yiqun Data and Phoenix Overseas Resources continue to promote large datasets.

These brokers often claim to provide customized data services alongside bulk records, further enhancing their perceived legitimacy.

Technical validation of advertised datasets reveals consistent signs of manipulation. In one example, a dataset allegedly containing 600,000 credit card records from a Gulf-based bank displayed multiple inconsistencies, including mixed-language name fields and poorly translated Arabic terms.

New Corporate Data Leaks

GroupIB analysis, researchers traced the data back to older breaches, such as the Facebook 2021 leak and the Eatigo 2020 incident, demonstrating that the dataset was artificially assembled.

Phoenix Overseas Resources also reused data from the 2022 Truecaller leak, further confirming a broader trend of aggregating historical breach data into misleading packages.

These recycled datasets are often referred to as “lead data,” characterized by inconsistent field values, mismatched records, and unrealistic formatting.

Linguistic anomalies, such as incorrect translations or unusual terminology, provide additional indicators that the data is not sourced from legitimate production systems.

Another case involving Yiqun Data showed similar patterns, where personal details like names and phone numbers originated from the Facebook leak, while password hashes were pulled from unrelated breaches.

Group-IB also observed distinct behavioral patterns among these brokers. Many channels post hundreds to thousands of messages monthly, a volume that would be implausible if each claim represented a genuine breach.

Advertisements typically follow a consistent structure, including spreadsheet-style sample images, record counts expressed in Chinese numerical terms, and references to well-known organizations to increase credibility.

The primary upstream sources for this recycled data include large-scale historical leaks containing personally identifiable information, particularly the Facebook 2021 dataset.

These datasets provide a rich foundation for brokers to recombine, repackage, and resell information with minimal effort.

Despite their low credibility, these campaigns pose a real operational challenge. Security teams may spend significant time validating false claims, diverting attention from legitimate threats.

Group-IB emphasizes that organizations should adopt structured analytical approaches to assess such data, focusing on validation, source tracing, and pattern recognition.

Ultimately, the findings underscore a growing tactic within cybercrime ecosystems where perception is weaponized.

By flooding channels with high-volume, seemingly credible data leak claims, threat actors are not only monetizing old breaches but also exploiting the limited visibility many organizations have into these underground networks.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.