Actor claims leak of 6.58M internal logs from Nodeflux
A threat actor posted a free download on an underground forum claiming to contain about 6.58 million internal event records from Nodeflux, a Jakarta-based computer vision and facial-recognition company. The claimed set includes access and secret keys, emails, account IDs and user data, with a cited breach date of Oct 21, 2026 and 'no ransom, just leak' framing. Nodeflux has not confirmed the incident; any exposed access keys should be treated as compromised and rotated.
What happened
A threat actor posted a free download on an underground forum claiming to contain about 6.58 million internal event records from Nodeflux, a Jakarta-based facial-recognition company. The claimed set includes access keys, emails, account IDs and user data. The company has not confirmed the incident.
Why it matters
If the claimed keys are still valid, they could open Nodeflux systems and possibly customer deployments to further intrusion, according to DailyDarkWeb's analysis. The set includes emails, IP addresses and payment methods. This is an unverified threat-actor claim, not a confirmed breach.
What to do
Treat any exposed access key as compromised and rotate it. Review access logs for Nodeflux systems and deployments using its credentials. Wait for the company's official statement before drawing conclusions.
For the technical team
- Affected
- Nodeflux, empresa de visão computacional de Jacarta (Indonésia), conhecida por sistemas de reconhecimento facial e vigil · Nodeflux, a Jakarta-based computer vision and facial-recognition company known for surveillance systems.
- Exploitation
- Threat-actor claim on an underground forum, reported by DailyDarkWeb; no confirmation from Nodeflux and flagged by the source as an unverified claim.
- Fix
- No fix applicable (leak). Mitigation stated by the source: treat any leaked access key as compromised and rotate it.
- Vector
- Free download posted on an underground forum containing internal logs and access keys; how the data was obtained is not described in the source.
- More details
- Claimed set: about 6.58 million event records, 1.7GB uncompressed JSON Lines, 136MB compressed. Claimed contents: access and secret keys, emails, account IDs, login details, IP addresses, payment methods and timestamps. Actor cites Oct 21, 2026 as the breach date and uses 'no ransom, just leak' framing. DailyDarkWeb analyst note: leaked keys are the urgent part, as they could open Nodeflux systems and customer deployments to further intrusion.
Timeline
First report: actor offers 6.58 million internal Nodeflux event records.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
