This report summarizes categories of stolen data observed being offered for sale on monitored underground channels during June 2026. All figures reflect distinct listings recorded through LeakTrace passive observation. No underlying stolen records are stored, purchased, or redistributed at any point in the pipeline.
Method
LeakTrace analysts monitor a rotating set of Telegram channels, Discord servers, and English-language underground forums where stolen data is offered to buyers. Only the listing metadata is recorded: sector, human-readable category, region, date observed, and the seller's stated volume. Screenshot references of the listing post itself are retained internally for audit purposes.
The categorization is deliberately vague at the level published here. A row labeled "dental practice patient records" tells you what type of data is being traded, not which practice or which patients. That aggregation is a compliance decision, not a technical limitation.
What was observed in June 2026
Across the monitored channels, our team recorded 0 distinct listings during June 2026. 0 were relevant to Canadian buyers, 0 to US buyers. Cross-border listings appear in both counts. The distribution by sector:
| Sector | Listings |
|---|
Categories tracked this month
The following category labels appeared at least once in the observation set for June 2026. This is the level of granularity we publish externally.
What this tells you
A category appearing in this report means the type of data associated with a given sector is actively being traded on channels our analysts monitor. It does not mean any specific business or individual has been breached. It does mean that the reconnaissance-and-selling pipeline for that sector is functioning, and that operators are willing to invest effort in packaging that data for buyers.
The most reliable read for a business in the multiple sectors sector: the volume of trading in your category has crossed the threshold where automated attackers and their downstream buyers see profitable returns. That means the frequency of attempts against businesses in your sector is above the industry median.
What to do next
Review your access controls, backup posture, and third-party integrations. If any of the categories listed above align with data you or your organization holds, treat the observation as external corroboration that your risk profile is being priced by the market.
If you already carry active LeakTrace monitoring, you will receive weekly digests summarizing observations relevant to your sector and region. If not, a free scan is available at /individual/. Businesses can request a targeted external-surface assessment at /business/.
This report will be updated on the first business day of each month with the prior month's observations.