Incident Overview

A threat actor operating under the handle "xploitleaks" claims to be selling access to an alleged data breach of an unidentified Iranian online medical platform. According to the advertisement, the database contains information on over 700,000 Iranian citizens. The threat actor states the data is only available through their Telegram channel and provides sample records demonstrating the type of information allegedly compromised.

The claimed database allegedly includes personal identifiers such as names, surnames, national identification numbers, father names, phone numbers, and usernames. The threat actor also claims to be providing full access credentials to the online platform for each user record in the database. For contact, the threat actor directs interested parties to reach out via their Telegram support channel.