Egypt
B2B Commerce
User & Phone Data
Free Leak
Unverified
Capiter Data Leak Claim Exposes 208,206 User Accounts and Phone Numbers
Overview
An actor using the handle "GoreTerminal" claims to have leaked a Capiter dataset containing approximately 208,206 user accounts. The post describes Capiter as an Egyptian B2B startup founded in Cairo that permanently shut down in 2023.
The actor states the breach occurred on October 28, 2026 at 10:11 AM EDT and characterizes the release as a leak rather than a ransom event. The archive is described as JSON Lines, with an uncompressed file named CAPITER_UNIQUE.JSONL at 150 MB and a compressed archive at 34 MB. The visible schema includes phone numbers, international phone numbers, customer IDs, country, carrier, city, district, area, order and product metadata, payment type, inventory data and profile timestamps. The dataset, its source, the stated counts and current availability have not been independently verified.
Post details
EgyptWhat the post claims
- Approximately 208,206 user accounts
- 208K+ phone numbers
- JSON Lines format
- 150 MB uncompressed file
- 34 MB compressed archive
- Phone and international-phone fields included
- Customer IDs included
- Country and carrier fields included
- City, district and area fields included
- Order IDs and order-position fields included
- Order-status fields included
- Product IDs, ranks and categories included
- Inventory-related fields included
- Payment-type fields included
- Offer and retry-count fields included
- Profile-created timestamps included
- Sample records displayed
- Free download advertised
The sample shown in the source material contains structured customer and transaction-related records. Individual phone numbers, customer identifiers and other personal values visible in the sample are not transcribed in this report.
Screenshots
IOCs & identifiers
Identifiers directly visible or supported by the supplied material. These support correlation and do not independently verify the breach claim.
| Type | Identifier | Source |
|---|---|---|
| Actor handle | GoreTerminal | Screenshots 1–2 |
| Named organization | Capiter | Screenshots 1–2 |
No organization domain, malware hash, Tox ID, Session ID, Telegram handle or attacker-controlled IP address is visible in the supplied screenshots. Personal identifiers shown in the sample are not included in this table.
Mapped techniques
Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.
- Collection T1213.006 Data from Information Repositories: Databases Inferred The listing presents a structured JSONL dataset containing customer, phone, order and product-related fields. The supplied material does not disclose how the data was obtained or independently establish unauthorized access to Capiter systems.
Potential impact
If authentic, the claimed dataset could expose mobile phone numbers, customer identifiers, location information and transaction-related metadata for more than 200,000 accounts. The combination could support targeted phishing, SMS abuse, impersonation, profiling or other customer-focused social engineering.
Status Unverified
Dark Web Informer has not independently verified the dataset's authenticity, source, completeness, 208,206-account count, archive sizes, sample contents or the actor's claimed October 28 breach time. The supplied screenshots document the listing and visible sample records, not independent confirmation of the underlying data.
