Cyber incidents can disrupt critical services, economies, and public trust. Discover why governments are shifting from cybersecurity prevention to coordinated crisis management and national resilience.
Nearly 100 executives and cybersecurity leaders from Israel’s energy sector participated in a large-scale cyber crisis exercise designed to strengthen resilience, improve decision-making, and enhance coordination during a national cyber emergency.
AI chats may feel private, but they can become searchable, recoverable, and even legally relevant records. Adv. Michal Bartov, DPO at Code Blue, outlines the privacy risks and practical safeguards every user should know.
Ransomware readiness testing helps organizations validate their ability to respond, communicate, and recover during an attack. Learn how tabletop exercises, role-based playbooks, and isolated restore testing reveal gaps before cybercriminals do.
A real-world ransomware case study showing how Code Blue and Blue Castle helped a healthcare organization manage operational disruption, data exposure risk, executive decision-making, and recovery under pressure.
Cyber incidents are no longer judged only by what went wrong, but by how prepared the organization was to respond. A recent Israeli sanction under Amendment 13 of the PPL shows why readiness, documentation, and timely reporting are now global regulatory priorities. This article explores the challenge and suggests practical steps organizations can take to reduce regulatory exposure.
Behind every cyber crisis is an attacker with different motives, capabilities, and objectives. This gallery reveals who was responsible for the incidents Code Blue managed during the first half of 2026.
Navigate the key cyber trends shaping 2026 through an interactive experience covering AI-driven threats, ransomware evolution, and cyber resilience priorities.
Multiple dark web marketplaces are allegedly facilitating large-scale trafficking of stolen financial data, compromised credentials, and personally identifiable information (PII) affecting hundreds of thousands of individuals and organizations globally. The most significant development is the emergence of coordinated marketplace operations like DOC-SHOP and Cerberux Market, which claim to offer access
Between October 8-9, 2026, multiple dark web marketplaces experienced significant activity involving the sale of massive databases containing stolen financial credentials, personally identifiable information (PII), and fraud-as-a-service offerings. The most significant development involves the alleged third domain hijacking of Dread marketplace by threat actor 'NoHugBunter', who is allegedly demanding ransoms
Between October 6-8, 2026, multiple dark web marketplaces experienced a coordinated surge in cybercriminal activity, with threat actors allegedly offering comprehensive fraud toolkits, massive stolen databases, and cybercrime-as-a-service platforms. Most significantly, threat actor KryptonZambie allegedly leaked 183.7 million records from DemandScience (formerly Pure Incubation) for $6,000, confirmed by Have I
Multiple threat actors are allegedly operating coordinated dark web marketplace campaigns advertising comprehensive fraud-as-a-service platforms. The Debay marketplace, heavily promoted across CryptBB forums, allegedly offers SIM swapping, social engineering, database hacking, and cryptocurrency draining services. Concurrently, DOC-SHOP and TRA-03.VIP marketplaces allegedly advertise massive inventories of stolen financial credentials, personal identification
Between October 3-6, 2026, multiple threat actors allegedly operated large-scale data trafficking operations across dark web marketplaces, offering stolen credentials, financial data, and personally identifiable information (PII) affecting millions of individuals globally. The most significant development is the emergence of massive credential databases totaling over 1.1TB with approximately 35 billion
Between October 5-6, 2026, multiple dark web marketplaces allegedly experienced a coordinated surge in fraud-as-a-service advertisements, large-scale database leaks, and sophisticated cryptocurrency theft operations. The most significant development is the alleged emergence of MELLCARTEL's cryptocurrency hijacking operation claiming $20M+ in targeted theft capabilities, combined with widespread advertising of the Debay
Between October 3-4, 2026, two significant cybersecurity events emerged from dark web monitoring: a verified data breach affecting brandsoflatam.com exposing 84,924 customer records, and an extensive advertising campaign for the Debay fraud marketplace across CryptBB forum by multiple threat actors. The Debay marketplace allegedly offers comprehensive criminal services including database
Multiple dark web marketplaces are allegedly facilitating the large-scale distribution of compromised credentials, payment card data, and cybercriminal services throughout early October 2026. Threat actors are reportedly offering billions of stolen records, including approximately 35 billion credentials through DB MARKET CLOUD and 431,300 payment cards via LIMECC marketplace. Additionally, the
Between October 2-3, 2026, multiple threat actors allegedly conducted a coordinated advertising campaign promoting the 'Debay' fraud marketplace across CryptBB dark web forums. The marketplace allegedly offers comprehensive cybercrime services including database breaches, SIM swapping, social media account takeovers, cryptocurrency drainers, and financial fraud schemes. Concurrently, threat actors Frouzenx, KerberusCroww,
Between September 30 and October 1, 2026, multiple threat actors allegedly orchestrated a coordinated wave of credential theft operations, resulting in the claimed exfiltration and distribution of over 57 million authentication records across dark web marketplaces. The most significant development involves LeakZero's alleged acquisition of 40 million rows of private
Between September 29-30, 2026, multiple threat actors allegedly conducted a coordinated advertising campaign promoting 'Debay,' a verified fraud marketplace, across CryptBB and CRDPro dark web forums. The marketplace allegedly offers comprehensive criminal services including SimSwap attacks, database/website hacking, social engineering, cryptocurrency drainers, and stolen payment card sales. At least nine
Multiple dark web marketplaces are allegedly conducting large-scale operations trafficking stolen financial data, compromised credentials, and fraud-as-a-service offerings across global jurisdictions. Between September 28-29, 2026, threat intelligence monitoring identified at least nine distinct marketplace operators advertising stolen credit card databases containing hundreds of thousands of records, compromised email credentials spanning
Multiple dark web marketplaces are allegedly facilitating large-scale sales of stolen financial data, compromised credentials, and cybercriminal services across global jurisdictions. Between September 27-28, 2026, threat actors operating on platforms including CryptBB, CRDPRO, Enclave, and Exploit forums allegedly advertised massive inventories of stolen credit cards (52,698+ cards), bank credentials (7,881+
Between September 25-27, 2026, multiple threat actors allegedly conducted widespread credential trafficking operations across dark web marketplaces, offering massive databases containing billions of compromised email-password combinations, stolen payment card data, and personal identifiable information (PII). The scale of these operations is unprecedented, with one actor allegedly claiming access to 35
Between September 26-27, 2026, multiple significant cybersecurity incidents emerged demonstrating coordinated financial fraud operations, critical infrastructure vulnerabilities, and extensive dark web marketplace activity. Most critically, alleged threat actor Blacknet00 claimed a comprehensive breach of FiveWest, a South African financial services platform, allegedly exfiltrating Firebase authentication keys, cryptocurrency wallet credentials, banking
Multiple threat actors are allegedly operating comprehensive fraud marketplaces on dark web platforms including CryptBB, Dread, and other forums, offering extensive criminal services that pose significant risks to organizations across all sectors. The marketplaces allegedly provide fraud-as-a-service operations including malware distribution (crypto drainers, RATs, keyloggers), social engineering tools, database hacking
Multiple dark web marketplaces, primarily DOC-SHOP and associated platforms, are allegedly conducting large-scale operations selling stolen financial credentials, personally identifiable information (PII), and compromised account access targeting US financial institutions, retail chains, airlines, and payment services. The significance of this activity lies in the comprehensive nature and scale of the
A coordinated surge in dark web marketplace activity has allegedly exposed critical vulnerabilities across financial, government, and enterprise sectors. Multiple threat actors are actively marketing stolen credentials affecting over 38 billion records, compromised payment card data from major retailers and financial institutions, and fraud-as-a-service platforms offering database hacking and social
Multiple dark web marketplaces are allegedly conducting large-scale operations selling compromised financial data, stolen credentials, and fraud-as-a-service offerings targeting major US financial institutions, retailers, and payment systems. The most significant development is the alleged exposure of over 100,000 compromised financial records including banking credentials from major institutions like Bank of
Between September 10-21, 2026, multiple dark web marketplaces allegedly facilitated large-scale trafficking of stolen financial credentials, with threat actors claiming to offer millions of compromised credit cards, bank logs, and personal identifying information across global platforms. Concurrently, a verified North Korean state-sponsored campaign (WaterPlum) allegedly infected approximately 33,000 devices worldwide
Between September 20-21, 2026, multiple threat actors allegedly operated coordinated fraud marketplaces on dark web platforms, advertising the sale of tens of thousands of stolen credit card records and comprehensive cybercrime services. The actors claimed to offer over 50,000 compromised payment cards with validity rates between 65-92% at prices ranging
Between September 19-20, 2026, multiple threat actors allegedly operated comprehensive fraud-as-a-service marketplaces across dark web platforms including CryptBB, Dread, and DarkForums. The most significant development is the proliferation of the 'Debay' marketplace, which allegedly offers a full spectrum of cybercriminal services including database hacking, SIM swap attacks, social engineering, cryptocurrency
Multiple threat actors are allegedly operating coordinated financial crime marketplaces across dark web platforms, advertising the sale of stolen payment card data, compromised bank credentials, and cybercrime services. Between September 17-18, 2026, at least 10 distinct actors posted advertisements across five dark web forums (ascarding, cryptbb, altenen, crackingx, xss_is) offering
Between September 17-18, 2026, multiple coordinated threat actor groups allegedly conducted large-scale financial fraud operations across dark web marketplaces (Altenen, CryptBB, DarkForums), targeting major US financial institutions, payment platforms, and retail organizations. The operations allegedly involved the sale of stolen credit card credentials, compromised bank accounts, personally identifiable information (PII),
Between September 15-16, 2026, multiple threat actors allegedly orchestrated a coordinated financial crime operation across dark web marketplaces, offering stolen payment card data, compromised bank credentials, and personally identifiable information (PII) affecting major financial institutions and payment platforms globally. The operation allegedly involves at least 10 distinct threat actors selling
Between September 15-16, 2026, multiple threat intelligence sources revealed a significant escalation in dark web marketplace activity, massive data breaches, and the proliferation of fraud-as-a-service operations. Most critically, threat actors allegedly advertised a 9.5TB database containing aggregated dark web leaks spanning 2020-2026, while another group claimed responsibility for exfiltrating 340GB
Between September 14-15, 2026, multiple threat actors allegedly conducted coordinated promotional campaigns across dark web marketplaces (Altenen, CryptBB, CrdPro, Enclave, CrackingX, ReHub) advertising large-scale financial fraud services, stolen payment card data, and fraud-as-a-service operations. The actors allegedly offered over 33,000 compromised credit card records, 275,000 stolen email/password combinations, and comprehensive
Between September 12-13, 2026, multiple threat actors allegedly conducted coordinated advertising campaigns across dark web marketplaces (CryptBB, CrdPro, Crackingx, Altenen) promoting comprehensive fraud-as-a-service operations. The most significant development is the alleged emergence of the Debay marketplace as a centralized hub for cybercrime services, with at least five verified sellers advertising
Between September 10-12, 2026, multiple threat actors allegedly conducted coordinated advertising campaigns across dark web marketplaces promoting fraud-as-a-service platforms, stolen financial data, and compromised databases. The most significant development is the emergence of 'Debay,' a verified fraud marketplace allegedly offering comprehensive cybercriminal services including database hacking, SIM swapping, cryptocurrency drainers,
Between September 10-11, 2026, multiple threat actors allegedly conducted coordinated sales of stolen financial data, compromised credentials, and fraud-as-a-service offerings across at least seven dark web marketplaces (Altenen, CrdPro, BFD Forum, Reversing Center, Cracked, XSS, CryptBB). The actors allegedly offered stolen credit card data (CVV/FULLZ), bank logs, compromised accounts for
Between September 4-9, 2026, multiple threat actors allegedly operated coordinated financial crime and data theft marketplaces across at least six dark web forums (Altenen, Enclave, CryptBB, DarkForums, 4cheat, XReactor). These actors allegedly advertised comprehensive criminal services including stolen payment card data from 27+ countries, compromised bank credentials from major US
Between 2025 and mid-2026, the global cybersecurity landscape experienced a dramatic escalation in ransomware attacks, data breaches, and dark web marketplace activity. Allegedly, over 9,300 ransomware-related incidents occurred with 66 new cybercriminal groups emerging, while 164 public database breaches allegedly exposed over 600 million user records globally. The Qilin ransomware
Between September 2-5, 2026, Israeli entities faced a convergence of cyber threats spanning government database breaches, geopolitical attacks, and inclusion in global financial crime operations. Most critically, threat actor CrimsonBlack allegedly breached the Yehud-Monosson Municipality's social welfare database, exposing 135 MB of sensitive citizen intake records including domestic violence cases
Israeli entities are allegedly facing coordinated cyber threats across multiple domains, including a claimed massive data breach of the Israeli Institute for National Security Studies (INSS) and ongoing financial crime operations targeting Israeli credit card holders. The INSS breach claim, allegedly perpetrated by Sumud Cyber Command, represents a significant geopolitical
Israeli law enforcement arrested a 40-year-old cybersecurity specialist from Ashkelon on August 18, 2026, for allegedly deploying WindowsAudit RAT malware against at least 25 Israeli organizations, with potential victims numbering in the dozens or hundreds. The arrest represents a significant insider threat case where a trusted security professional allegedly exploited
Between August 28-31, 2026, multiple threat actors allegedly advertised the sale of compromised databases containing extensive personally identifiable information (PII) and financial data affecting Israeli citizens and residents, alongside victims from 40+ other countries. The most significant alleged breach involves a Tier 1 database with 600,000 complete identity records including
Between August 26-30, 2026, multiple threat actors allegedly conducted cyber operations with Israeli nexus across three distinct activity clusters: (1) A Turkish nationalist hacktivist group claimed mass website defacement of 1,952 sites and DDoS attacks against Israeli government infrastructure including space.gov.il as part of a commemorative operation; (2) A carding
Threat actors are allegedly conducting an active stolen credit card sales operation specifically targeting customers of Hapoalim, a major Israeli banking institution. The operation involves bulk stolen credit card data from multiple countries with pre-validated cards that allegedly bypass OTP verification and can be used with digital payment platforms including
On August 26, 2026, a threat actor allegedly offered for sale a comprehensive collection of compromised military data from over 14 countries, including Israel, for $10,000 USD. The Israeli Defense Forces (IDF) is explicitly listed among the targeted military organizations. This alleged breach represents a significant threat to Israeli national
On August 26, 2026, threat actor MrDarkRoot allegedly advertised a large-scale sale of compromised military data from 14+ countries, including sensitive Israeli Defense Forces intelligence, for $10,000 USD. Concurrently, the Authorize marketplace was allegedly selling stolen credit card data (CC+CVV2) from multiple countries including Israel, sourced via sniffer tools. These
