> ## Content Index > Fetch the complete content index at: https://darkwebinformer.com/llms.txt > Use this file to discover other available public pages before exploring further. # Conference-Space Company Breach Claim Says Access Remains Live With 6,027 Users and 115,948 Attachments - URL: https://darkwebinformer.com/conference-space-company-breach-claim-says-access-remains-live-with-6-027-users-and-115-948-attachments/ - Published: 2026-10-16T17:05:11.000Z - Updated: 2026-10-16T17:05:11.000Z - Author: Dark Web Informer - Tags: Data Breaches Initial Access & Data Exposure Report Conference Technology Support Platform Data Access Still Live Unverified ## Conference-Space Company Breach Claim Says Access Remains Live With 6,027 Users and 115,948 Attachments Claimed company revenue$80M–$100M Users6,027 Tickets24,753 Attachments115,948 Severity HIGH ### Overview An actor using the handle **"Erich"** claims to have breached an unnamed conference-space company with approximately **$80 million to $100 million in annual revenue**. The actor says the compromise came through a support panel and claims that access remains active. The post lists **24,753 tickets**, **387,388 comments**, **274,294 system notes**, **113,094 real replies**, **115,948 attachment rows** and **6,027 users**. The actor also claims the attachments include debug logs and some 2018 NATO-related material observed during a quick review. **The breach, continued access, dataset contents and client associations have not been independently verified.** ### Post details OrganizationUnnamed conference-space company SectorConference technology / support services Actor"Erich" Claimed revenue$80M–$100M Access statusActor claims access is still live Entry point describedSupport panel Users listed6,027 Observed dateOct 16, 2026 ### What the post claims - 24,753 support tickets - 387,388 comments - 274,294 system notes - 113,094 real replies - 115,948 attachment rows - 6,027 users - All 6,027 users claimed to have an email address - User IDs included - Avatar initials included - Email-header data included - First and last names included - Phone numbers included - Company IDs and company names included - Department and location fields included - Last-seen timestamps included - IP addresses and user-agent fields included - Ticket and reply-count fields included - Language and deactivation fields included The actor says no attachment files were downloaded, but claims access to them remains available. The post also says a quick review of roughly 1,000 files showed debug logs and some NATO-related information from 2018. Sponsored [ ![WhiteIntel, dark web exposure monitoring](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/whiteintel_io_banner.jpg) ](https://whiteintel.io/?utm%5Fsource=darkwebinformer.com&utm%5Fmedium=referral&utm%5Fcampaign=whiteintel) ### Screenshots [ Screenshot 1Source screenshot ![Post claiming a live breach of an unnamed conference-space company, including support tickets, comments, users, attachments and client-category information](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/10/conference_space_company.png) ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/10/conference%5Fspace%5Fcompany.png) The supplied capture shows the claimed live access, stolen-data counts, user-field statistics, client categories and a Session contact identifier. No underlying ticket content or attachment files are visible in the screenshot. ### Client categories named - European institutions and international organizations - National governments, parliaments and public-sector bodies - AV integrators, distributors and consultants - Manufacturers and technology partners - Corporate and enterprise clients The actor names numerous public-sector, international, technology and enterprise organizations as clients of the breached company. The screenshot does not establish that those organizations were themselves directly compromised. ### IOCs & identifiers Identifiers directly visible in the supplied material. These support correlation and do not independently verify the breach claim. | Type | Identifier | Source | | ------------ | ------------------------------------------------------------------ | ------------ | | Actor handle | Erich | Screenshot 1 | | Session ID | 050d21ed580450edf8a9deb238f8da1fc2a0da3595e45ff570c92248ebce31ac58 | Screenshot 1 | No victim domain, malware hash, Tox ID, Telegram handle or attacker-controlled IP address is visible in the supplied screenshot. The target company is not named in the source material. ### Mapped techniques **Claimed** identifies behavior explicitly described by the actor. **Inferred** identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified. - Collection [T1213](https://attack.mitre.org/techniques/T1213/) [Data from Information Repositories](https://attack.mitre.org/techniques/T1213/) Inferred The actor claims to have extracted structured support-platform data including tickets, comments, notes, users and attachments. - Collection [T1119](https://attack.mitre.org/techniques/T1119/) [Automated Collection](https://attack.mitre.org/techniques/T1119/) Inferred The volume and structured export-style counts described in the post are consistent with bulk or automated collection if the claim is accurate. ### Potential impact If authentic, the claimed exposure could reveal **support communications, user identity and contact data, company relationships, IP addresses, user-agent information and potentially sensitive attachment contents**. Continued access would also increase the risk of additional data collection or exposure beyond the material already described. ### Status Unverified Dark Web Informer has **not independently verified** the compromise, target identity, claimed live access, revenue estimate, dataset counts, attachment contents or client relationships described by the actor. The supplied screenshot documents the claim and listed statistics, not independent confirmation of the underlying breach. Want everything on this threat? **Paid subscribers** get the full unredacted claim details and more. After subscribing, check out the [threat feed](https://darkwebinformer.com/threat-feed/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=conference-space-access-2026-10-16&utm%5Fcontent=threat-feed) and search there for this alert. [View pricing →](https://darkwebinformer.com/pricing?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=conference-space-access-2026-10-16&utm%5Fcontent=pricing-button) [Dark Web Informer](https://darkwebinformer.com/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=conference-space-access-2026-10-16&utm%5Fcontent=footer)