logo

85,000 MySQL Databases On Sale In Darkweb

ID: 0dccae8e-ec01-579e-b927-356c85f3ac0d

STIX ID: report--0dccae8e-ec01-579e-b927-356c85f3ac0d

Feed Name: Cyble Blog

Threat Score
75/100

Date Published: 2026-03-26

Date Updated: 2026-07-17

...
...

Cyble reports that a threat actor calling itself "Trollx" has posted over 85,000 MySQL databases for sale on a Russian-speaking hacking forum and a linked .onion auction site, publishing a list of compromised databases and offering access codes to buyers; Cyble links the compromises to mass exploitation techniques such as SQL injection and exposed configuration files, warns that databases are auctioned if victims refuse ransom, and provides guidance for reducing exposure.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.