Actor 'GoreTerminal' claims leak of Capiter database with 208,206 user accounts and phone numbers
An actor using the handle GoreTerminal claims to have leaked a dataset from Capiter, an Egyptian B2B startup founded in Cairo that shut down in 2023. The post describes roughly 208,206 user accounts and presents the release as a leak, not a ransom event. The actor dates the breach to October 28, 2026 at 10:11 AM EDT. Dark Web Informer has not verified the dataset's authenticity, source, completeness, account count, archive sizes or breach time, and the material does not show how the data was obtained.
Detalhes técnicos
- The archive is described as JSON Lines: CAPITER_UNIQUE.JSONL (150 MB uncompressed) and a 34 MB compressed archive.
- The visible schema includes phone and international phone numbers, customer IDs, country, carrier, city, district and area.
- It also includes order IDs and order-position and status fields, product IDs, ranks and categories, inventory fields, payment type, offer and retry-count fields, and profile-created timestamps.
- No organization domain, malware hash, Tox ID, Session ID, Telegram handle or attacker IP is visible in the supplied screenshots.
- Analytical ATT&CK mapping (inferred, not verified): Collection via T1213.006 (Data from Information Repositories: Databases).
- If authentic, the data could support targeted phishing, SMS abuse, impersonation and profiling of customers.
Remediação
The article gives no remediation guidance. Because the dataset is unverified and the company is defunct, former Capiter customers in Egypt should treat unsolicited SMS and calls that reference past orders with caution.
Linha do tempo
-
Actor 'GoreTerminal' claims leak of Capiter database with 208,206 user accounts and phone numbers
ler a análise desta fonte ocultar
An actor using the handle GoreTerminal claims to have leaked a dataset from Capiter, an Egyptian B2B startup founded in Cairo that shut down in 2023. The post describes roughly 208,206 user accounts and presents the release as a leak, not a ransom event. The actor dates the breach to October 28, 2026 at 10:11 AM EDT. Dark Web Informer has not verified the dataset's authenticity, source, completeness, account count, archive sizes or breach time, and the material does not show how the data was obtained.
Technical Details
- The archive is described as JSON Lines: CAPITER_UNIQUE.JSONL (150 MB uncompressed) and a 34 MB compressed archive.
- The visible schema includes phone and international phone numbers, customer IDs, country, carrier, city, district and area.
- It also includes order IDs and order-position and status fields, product IDs, ranks and categories, inventory fields, payment type, offer and retry-count fields, and profile-created timestamps.
- No organization domain, malware hash, Tox ID, Session ID, Telegram handle or attacker IP is visible in the supplied screenshots.
- Analytical ATT&CK mapping (inferred, not verified): Collection via T1213.006 (Data from Information Repositories: Databases).
- If authentic, the data could support targeted phishing, SMS abuse, impersonation and profiling of customers.
Remediation
The article gives no remediation guidance. Because the dataset is unverified and the company is defunct, former Capiter customers in Egypt should treat unsolicited SMS and calls that reference past orders with caution.