Threat actor claims sale of 11 million Cabonline taxi trips
A threat actor on a dark web forum claims to sell a database of 11,173,810 taxi trip order lines allegedly linked to Cabonline, the Nordic taxi group operating in Sweden, Norway, Finland and Denmark. According to the post, reported by DailyDarkWeb, the data covers October 2024 to October 27, 2026, includes pickup and drop-off locations, times, fares and vehicle/driver identifiers, and the asking price is 1,500. The claim is unverified, Cabonline has not confirmed it, and the data could come from a booking or dispatch partner.
What happened
A threat actor on a dark web forum claims to sell a database of 11,173,810 taxi trip order lines allegedly linked to Cabonline, the Nordic taxi group operating in Sweden, Norway, Finland and Denmark. The post says the data covers October 2024 to October 27, 2026, and lists an asking price of 1,500. The claim, reported by DailyDarkWeb, has not been independently verified and Cabonline has not commented.
Why it matters
The alleged fields include pickup and drop-off locations, dates and times, distances, fares, payment types, passenger counts and vehicle/driver identifiers. Per the DailyDarkWeb analyst note, such data can reveal home and work addresses, travel patterns and visits to sensitive locations even without names, and driver/vehicle IDs could expose drivers. Passengers and drivers of the group in the claimed period would be affected.
What to do
Treat it as an unverified claim and monitor Cabonline's official channels for a statement. Check booking and dispatch partners for unauthorized access, since the data could come from an integrator. If confirmed, notify customers and drivers about exposure of travel patterns.
For the technical team
- Affected
- Cabonline, grupo de táxis nórdico que opera na Suécia, Noruega, Finlândia e Dinamarca; base alegada de pedidos de corrid · Cabonline (cabonline.com), Nordic taxi group operating in Sweden, Norway, Finland and Denmark. Alleged data: 11,173,810 trip order lines from October 2024 to October 27, 2026.
- Exploitation
- Sale announcement on an underground forum reported by DailyDarkWeb. Claim not independently verified; Cabonline has not confirmed the incident.
- Fix
- Not applicable to an alleged data leak.
- Vector
- Not described in the sources. The post does not prove where the data came from; per the DailyDarkWeb analyst, it could originate from a booking or dispatch partner.
- More details
- The post describes the database as coming from a large taxi ordering service integrated into booking, asks 1,500 and directs buyers to send a private message. It includes a sample of order IDs and timestamps without proving provenance. Alleged fields: pickup and drop-off locations, dates and times, distances, fares, payment types, passenger counts and vehicle/driver identifiers. Per the analyst, trip data with timestamps and pickup/drop-off points can reveal addresses and travel patterns.
Timeline
Forum post advertises sale of 11.17 million Cabonline-linked taxi trip records.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
