Colorbox · Breach

[Single source] Actor claims leak of 7.67 million Colorbox rows

Nov 09, 2026 · 1 min read

A threat actor claims a leak of a Colorbox database with 7.67 million rows containing customer, shipping and invoice data, according to @DarkWebInformer. The company has not confirmed the claim. Customers should watch for scams and change reused passwords.

By HIFY Radar newsroom Updated 11/09/2026 04:44 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In 30 seconds

Alleged

Threat-intelligence outlet DarkWebInformer has publicized a claim that a Colorbox database was leaked, with the dataset described as containing 7.67 million rows including customer, shipping and invoice data. The claim surfaced on November 9, 2026 through both DarkWebInformer's website and its X account.

Inferred

No confirmation from Colorbox and no independent corroboration is present in the available evidence. The figure and the contents of the dataset are entirely actor-asserted at this stage.

What happened

Observed

On November 9, 2026, DarkWebInformer published an article headlined "Colorbox Data Leak Claim Lists 7.67 Million Rows With Customer, Shipping and Invoice Data" and simultaneously posted the same alert to X.

Alleged

According to the alert, a threat actor claims to be offering a Colorbox dataset of 7.67 million rows, with the material said to span customer, shipping and invoice data.

Inferred

The X post carrying the claim was tagged with a French flag emoji, which may hint at a France-linked company or actor, though the posts themselves do not explain the marker.

Why it matters

Inferred

If genuine, a dataset combining customer, shipping and invoice records would typically expose names, delivery addresses and purchase histories, which are directly usable for targeted phishing, identity fraud and social-engineering follow-ups.

Inferred

Large, single-source leak claims are frequently used by actors to build reputation, to pressure an alleged victim, or to push scam downloads, so the headline figure should not be treated as established fact until samples or a company statement emerge.

What to do

Inferred

Organizations tracking this incident should register it as an unverified claim, monitor for a Colorbox statement or sample-data releases, and avoid circulating the alleged dataset until its authenticity is assessed.

Inferred

Anyone who has transacted with Colorbox should be wary of unsolicited emails or calls referencing orders, shipments or invoices, and should not open attachments or follow links in such messages while the claim is unresolved.

Confirmed and still uncertain

Observed

What is established from the evidence: DarkWebInformer published the claim on November 9, 2026 on two channels, describing an alleged Colorbox dataset of 7.67 million rows containing customer, shipping and invoice data.

Observed

What is not established: the identity of the claiming actor, where the data was posted, whether samples were included, the time period the records cover, whether the data is authentic or current, and whether Colorbox has responded. The visible post does not name the actor or provide samples.

What people are saying

Observed

DarkWebInformer wrote on X: "‼️🇫🇷 Colorbox Data Leak Claim Lists 7.67 Million Rows With Customer, Shipping and Invoice Data", linking back to its own article.

Observed

No commentary from Colorbox, other researchers, or affected parties is present in the evidence batch; the discussion so far consists solely of DarkWebInformer's own channels.

Evolution

Observed

The story is at its earliest stage: the article and the X post appeared at the same time on November 9, 2026, and no follow-up developments, corrections, or confirmations have been observed in the batch since.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The only technical specifics in the claim are the volume, 7.67 million rows, and the stated content categories: customer data, shipping data and invoice data.

Observed

No file formats, database engine, field-level samples, breach vector, or ask price/demand are described in the available material, leaving the claim's technical substance impossible to evaluate from this evidence alone.

Sources and evidence

Observed

The evidence batch contains two items from a single outlet: DarkWebInformer's RSS article and the corresponding post on X by @DarkWebInformer, both timestamped November 9, 2026. The article body was not retrieved; only its headline is available.

Inferred

Because both items trace to the same publisher and the full article text is unavailable, all substantive claims here rest on one outlet's headline, and confidence in the leak itself should remain low pending independent verification.