Angi Data Sale, The Tour Guy Breach, Healthcare Leads, KPN Leak, and CafeMom Data Resurface

SOCRadar’s Dark Web team identified multiple underground posts claiming the sale or resurfacing of large datasets allegedly tied to Angi (4M records), The Tour Guy (3.8M records, including payment and auth data), healthcare leads across Australia/South Korea/Japan/China (2.3M records), KPN Netherlands (4.7M records), and historical CafeMom credentials (2.6M plain‑text passwords). If authentic, the combined exposures of PII, payment information, authentication tokens and plaintext passwords present a high risk for phishing, account takeover, payment fraud, SIM‑swap and credential‑stuffing attacks, though the report notes these are advertised on underground forums and not independently verified within the document.