Old Breaches Resold as New Corporate Data Leaks

Group-IB found that Chinese-language dark web forums and Telegram brokers are repackaging historical breach data (e.g., Facebook 2021, Eatigo 2020, Truecaller 2022) and advertising it as fresh, large-scale corporate leaks; these actors use structured ad formats, anonymized identities, and high post volumes to lend credibility, while dataset analysis reveals linguistic anomalies, mismatched fields, and recombined records that indicate manipulation rather than genuine new breaches.