Agências humanitárias da ONU citadas pelo… · Breach

[Single source] Claim: Actor offers 50 GB of UN humanitarian agency data

Nov 09, 2026 · 1 min read

A threat actor on a dark web forum is selling 50 GB they claim came from a compromised device belonging to a humanitarian staff member in Yemen. The seller names WHO, UNOCHA, UNDP, UNDSS, UNFPA and UNHCR, with spreadsheets, PDF and Word documents, identification cards and emails spanning 2017 to 2023. The claim has not been verified by the organizations.

By HIFY Radar newsroom Updated 11/09/2026 08:30 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Alleged

A threat actor on a dark web forum is offering a 50 GB dataset that they claim came from a compromised device belonging to a humanitarian staff member in Yemen, according to a report by DailyDarkWeb. The seller names WHO, UNOCHA, UNDP, UNDSS (including its radio communications unit), UNFPA and UNHCR, and says the files span 2017 to 2023.

Observed

This is an unverified threat-actor claim and not confirmation of a breach. None of the named organizations has commented so far.

What happened

Alleged

A post on a dark web forum, surfaced by the account DailyDarkWeb, advertises a 50 GB dataset for sale that the seller says originated from a compromised device belonging to a humanitarian staff member in Yemen.

Alleged

According to the post, the dataset includes spreadsheets, PDF and Word documents, identification cards, and email correspondence. A free sample is offered, and the full set is up for sale.

Why it matters

Inferred

As the reporting analyst note highlights, exposure of staff identification documents and security communications in Yemen could put aid workers and beneficiaries at real risk.

Alleged

The claim also names UNDSS's radio communications unit, meaning security-related material could be in the offering if the data proves authentic.

What to do

Observed

Treat the sale listing as an unverified threat-actor claim rather than confirmation of a breach, as the reporting itself cautions.

Inferred

Note that a single endpoint compromise, if it occurred, would not mean the agencies' own systems were breached; any organizational response should keep that distinction in mind.

Confirmed and still uncertain

Alleged

Known: a dark web forum post exists offering a 50 GB dataset, naming WHO, UNOCHA, UNDP, UNDSS, UNFPA and UNHCR, with files allegedly spanning 2017 to 2023 and including documents, ID cards and emails.

Observed

Unknown: whether the data is authentic, whether any device or system was actually compromised, and how the material was obtained. None of the named organizations has commented so far.

What people are saying

Alleged

The threat actor claims the dataset came from a compromised device of a humanitarian staff member in Yemen and is offering a free sample alongside the full sale.

Observed

DailyDarkWeb's analyst note stresses this is an unverified claim, not confirmation of a breach, and that a single endpoint compromise would not mean the agencies' own systems were breached.

Evolution

Observed

The public record currently consists of the single forum listing; none of the named organizations has commented so far, and there are no reported developments on authenticity or takedown.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The seller attributes the data to a compromised device belonging to a humanitarian staff member in Yemen, which if true would represent an endpoint compromise rather than a breach of agency infrastructure.

Alleged

The listed file types include spreadsheets, PDF and Word documents, identification cards, and email correspondence, with a free sample offered to prospective buyers.

Sources and evidence

Observed

This brief is based on a single source: a post by DailyDarkWeb on X describing the dark web forum listing. The underlying forum post and the dataset itself have not been independently verified.