ZeroFox Daily Deep and Dark Web Intelligence - October 19, 2026

ZeroFox Daily Deep and Dark Web Intelligence - October 19, 2026

Product Serial: D-2026-10-19a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web (DDW) ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 72 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including REDACT, INC Ransomware, n0n Ransomware, Qilin, and HYFLOCK.
• Vulnerability and Tooling Commercialization: Threat actors on DDW forums, DarkForums and Spear, advertised alleged zero-days, including an IDOR flaw in a New Zealand government certificates API and an account takeover exploit for Google accounts.
• Data Dissemination and Telemetry: Threat actors posted several breach and data sale claims referencing healthcare, government, and hospitality organizations. The most notable were cross-posted listings from actor “TheHatman” purportedly tied to AstraZeneca and Cardinal Health. Separately, credential intelligence systems ingested over 1.6 billion combined compromised account credentials (CAC) and botnet CAC between September 21 and October 18, 2026.