Claim: 1,838,412 IROOTECH rows allegedly…

HighBreachNo software to update

In 30 seconds

Alleged

A November 14 report says a dark-web forum user is distributing a database allegedly taken from Chinese industrial IoT provider IROOTECH. The claimed 1,838,412 rows remain unverified, and the report says IROOTECH has not publicly responded.

What happened

Alleged

According to DailyDarkWeb, the forum user claims the database came from an unsecured instance exposed in October 2026. The material is reportedly being given away and contains names, usernames, email addresses, phone numbers, roles, organization identifiers and conversations.

Why it matters

Inferred

If authentic, the combination of employee identities, corporate contact details and organizational roles could make supplier impersonation and business email compromise more convincing, particularly for companies connected to IROOTECH's industrial ecosystem.

What to do

Inferred

Organizations that work with IROOTECH should warn finance, procurement and support teams about convincing supplier impersonation, verify unusual payment or account-change requests through a separate channel, and watch for phishing that uses accurate employee or company details.

Confirmed and still uncertain

Observed

What is known from the supplied evidence is that DailyDarkWeb published the allegation and an accompanying image. The database's provenance, whether the records are genuine, how any instance became accessible and whether IROOTECH suffered a breach are not established. The report says the company has made no statement.

What people are saying

Contested

DailyDarkWeb says the sample resembles a user table from an exposed search index, but explicitly treats that assessment as unproven. It also says the forum post's allegations about government backdoors lack supporting evidence.

Evolution

Alleged

The claimed sequence begins with an unsecured instance allegedly exposed in October 2026. A forum user then reportedly offered the purported database, and DailyDarkWeb publicized the claim on November 14 while stressing that it did not confirm a breach.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Inferred

The reported fields include personal and corporate email addresses, phone numbers, usernames, roles, organization IDs and conversations. DailyDarkWeb's suggestion that the sample came from a search-index user table is a technical interpretation, not confirmed evidence of the system or access path involved.

Sources and evidence

Observed

The supplied evidence consists of one DailyDarkWeb post on X, including its summary of a dark-web forum listing and an attached image. No primary forum record, downloadable sample, independent validation, forensic report or statement from IROOTECH is included, so the central leak claim remains unverified.