> ## Content Index > Fetch the complete content index at: https://darkwebinformer.com/llms.txt > Use this file to discover other available public pages before exploring further. # Moveciti Administrator Access and Exported Database Offered for Sale With 1.18 Million Bus-App Documents - URL: https://darkwebinformer.com/moveciti-administrator-access-and-exported-database-offered-for-sale-with-1-18-million-bus-app-documents/ - Published: 2026-10-09T16:18:41.000Z - Updated: 2026-10-09T16:18:41.000Z - Author: Dark Web Informer - Tags: Data Breaches Initial Access & Data Sale Report ![Brazil flag](https://flagcdn.com/w20/br.png)Brazil Public Transportation Database Access For Sale Unverified ## Moveciti Administrator Access and Exported Database Offered for Sale With 1.18 Million Bus-App Documents Admin access$200 Exported database$150 Bundle price$300 Largest collection\~1.18M docs Severity HIGH ### Overview An actor using the handle **"DaOnlySpark"** claims to be selling **administrator access to Moveciti's database** along with a database export dated **October 9, 2026**. Moveciti is described in the listing as a digital mobility platform that provides bus schedules, real-time bus tracking and nearby stop information. The actor prices administrator access at **$200**, the exported database at **$150**, or both for **$300**. The listing describes multiple data collections spanning bus GPS data, route history, user accounts, saved favorites, rider information, device-login history, trips, vehicle data, identity-verification documents, push-notification jobs and uploaded profile or vehicle images. **The access, database export, collection counts and current availability have not been independently verified.** ### Post details OrganizationMoveciti Country![Brazil flag](https://flagcdn.com/w20/br.png)Brazil SectorPublic transportation / digital mobility Actor"DaOnlySpark" Admin access price$200 Exported database price$150 Bundle price$300 Export date claimedOct 9, 2026 ### What the post claims - Administrator database access offered for sale - Pre-exported database offered separately - Moveciti Bus App: 24 collections and \~1.18M documents - 686,665 live bus GPS location records - 260,784 route-bus history records - 163,466 per-user ride-count records - 42,442 app-user records - 6,196 favorite-route records - 3,255 favorite bus-stop records - 2,566 review-feedback records - 2,008 bus-stop records - 1,025 route-report records - Moveciti Viagens app: 30 collections and \~24K documents - 9,856 ride-offer event records - 7,621 marketing-event records with tracking metadata - 1,107 device-login-history records - 807 ride records - 663 rider-account records The listing also references vehicle records, rider transactions, registration leads, identity-verification jobs, administrator-user records and a separate document collection of roughly **354 MB across 26,826 files**. That document set is described as containing user profile photos, vehicle-registration documents, driver-profile images, driver-licence scans, ID/document verification scans, PIX payment QR-code images and other uploaded media. Sponsored [ ![WhiteIntel, dark web exposure monitoring](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/whiteintel_io_banner.jpg) ](https://whiteintel.io/?utm%5Fsource=darkwebinformer.com&utm%5Fmedium=referral&utm%5Fcampaign=whiteintel) ### Screenshots [ Screenshot 1Source screenshot ![Listing claiming administrator access and an exported Moveciti database for sale, including collection counts, pricing and mobility-platform data categories](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/10/moveciti.png) ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/10/moveciti.png) [ Screenshot 2Source screenshot ![Continuation of a Moveciti access and database-sale listing showing rider, vehicle, identity-document and uploaded-media collections plus Session, Telegram and XMR identifiers](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/10/moveciti_1.png) ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/10/moveciti%5F1.png) The supplied captures show the administrator-access and exported-database offer, pricing, collection names and record counts, document/media categories, and the actor's Session, Telegram and XMR identifiers. ### IOCs & contact identifiers Identifiers directly visible in the supplied material. These support correlation and do not independently verify the access or database-sale claim. | Type | Identifier | Source | | ------------------------- | ----------------------------------------------------------------------------------------------- | --------------- | | Actor handle | DaOnlySpark | Screenshots 1–2 | | Session ID | 05f0c154aa452d2d610628fb375d3ef80efb4a5c377b6ee409d99988d80f00605f | Screenshot 2 | | Telegram | @DaOnlySpark | Screenshot 2 | | XMR wallet | 89RAbi5JYC6coBuBSGkdSfAmoZUSKEEJsjmcsLtX1VYqDRL8G1kJTk3XbSvxtixe95S9ZQOmupH9EhvZ8PkYehNj5ufSYQ8 | Screenshot 2 | | Named organization domain | moveciti\[.\]com | Screenshot 1 | The organization domain identifies the company named in the claim, not malicious infrastructure. No malware hash or attacker-controlled IP address is visible in the supplied material. Personal identifiers and identity-document contents referenced in the purported database are not included in this table. ### Mapped techniques **Claimed** identifies behavior explicitly described by the actor. **Inferred** identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified. - Initial Access [T1078](https://attack.mitre.org/techniques/T1078/) [Valid Accounts](https://attack.mitre.org/techniques/T1078/) Inferred The actor claims to be selling administrator-level database access. The supplied material does not show how that access was obtained or whether it relies on compromised credentials. - Collection [T1213.006](https://attack.mitre.org/techniques/T1213/006/) [Data from Information Repositories: Databases](https://attack.mitre.org/techniques/T1213/006/) Inferred The actor claims to possess an exported database containing multiple structured collections and supporting files. The supplied screenshots do not independently establish the acquisition method or the authenticity of the export. ### Potential impact If authentic, administrator access combined with the claimed export could expose **user accounts, rider and driver information, GPS and trip history, device-login metadata, vehicle documents, driver-licence scans, identity-verification files and profile images**. The combination could support privacy abuse, targeted phishing, identity fraud or further unauthorized access to Moveciti systems. ### Status Unverified Dark Web Informer has **not independently verified** the administrator-access claim, the exported database, the October 9 export date, collection counts, document counts, pricing or current availability. The supplied screenshots document the sale offer and claimed database structure, not independent confirmation of access to Moveciti systems. Want everything on this threat? **Paid subscribers** get the full unredacted claim details and more. After subscribing, check out the [threat feed](https://darkwebinformer.com/threat-feed/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=moveciti-access-database-sale-2026-10-09&utm%5Fcontent=threat-feed) and search there for this alert. [View pricing →](https://darkwebinformer.com/pricing?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=moveciti-access-database-sale-2026-10-09&utm%5Fcontent=pricing-button) [Dark Web Informer](https://darkwebinformer.com/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=moveciti-access-database-sale-2026-10-09&utm%5Fcontent=footer)