This report summarizes categories of stolen data observed being offered for sale on monitored underground channels during August 2026. Everything here reflects listings recorded through LeakTrace passive observation. No underlying stolen records are stored, purchased, or redistributed at any point in the pipeline.
Method
LeakTrace analysts monitor a rotating set of Telegram channels, Discord servers, and English-language underground forums where stolen data is offered to buyers. Only the listing metadata is recorded: sector, human-readable category, region, date observed, and the seller's stated volume. Screenshot references of the listing post itself are retained internally for audit purposes.
The categorization is deliberately vague at the level published here. A row labeled "dental practice patient records" tells you what type of data is being traded, not which practice or which patients. That aggregation is a compliance decision, not a technical limitation.
What was observed in August 2026
Reported losses to internet crime reached $20.9 billion last year across more than a million complaints, and business email compromise alone accounted for $3.05 billion of it. The listings below are the supply side of that market. Both Canadian and US buyers were represented in August 2026; cross-border listings appear under both. Sectors are ranked by how often they appeared:
| Rank | Sector |
|---|---|
| 1 | Insurance |
| 2 | Healthcare / Medical |
| 3 | Legal / Law Firms |
| 4 | Financial Services |
| 5 | Restaurant / Hospitality |
| 6 | Real Estate |
| 7 | Small Business (Generic) |
| 8 | Education |
| 9 | Consumer Service |
| 10 | Retail / E-commerce |
Categories tracked this month
The following category labels appeared at least once in the observation set for August 2026. This is the level of granularity we publish externally.
- Insurance brokerage client lists
- Restaurant loyalty program data
- Real estate closing files
- Chiropractic patient files
- Real estate transaction records
- Bookkeeping firm client lists
- Small law firm case management exports
- Insurance broker client lists
- Small business payroll and HR exports
- Optometry patient databases
- Private school parent contact lists
- Mortgage broker application data
- Healthcare provider patient records
- Commercial policy underwriting files
- Dental practice patient records
- Home services provider customer records
- Independent retailer customer databases
- Wealth advisor client contact lists
- Property management tenant records
- Independent mortgage broker records
What this tells you
A category appearing in this report means the type of data associated with a given sector is actively being traded on channels our analysts monitor. It does not mean any specific business or individual has been breached. It does mean that the reconnaissance-and-selling pipeline for that sector is functioning, and that operators are willing to invest effort in packaging that data for buyers.
The most reliable read for a business in the insurance sector: the volume of trading in your category has crossed the threshold where automated attackers and their downstream buyers see profitable returns. That means the frequency of attempts against businesses in your sector is above the industry median.
What to do next
Review your access controls, backup posture, and third-party integrations. If any of the categories listed above align with data you or your organization holds, treat the observation as external corroboration that your risk profile is being priced by the market.
If you already carry active LeakTrace monitoring, you will receive weekly digests summarizing observations relevant to your sector and region. If not, a free scan is available at /individual/. Businesses can request a targeted external-surface assessment at /business/.
This report will be updated on the first business day of each month with the prior month's observations.