Q3 2026 Product Updates and Highlights

October 20, 2026

A look at new capabilities, platform improvements, and data updates across July, August, and September.

This quarter centered on three themes: Cases as the single place for your searches, findings, and alerts; clearer, more targeted search and Explore views; and the first structured Data Leak records, alongside new market analytics and notable leaks collected this quarter. Keep an eye out for more structured data in the coming quarters.

Cases Become the Home for Your Work

Investigations produce three kinds of output: searches, the findings those searches turn up, and the alerts that tell you when something changes. Until now, personal tools and Cases held those pieces in different places. This quarter we brought them together. Cases are now the one place where a search is saved, a finding is captured, and an alert is reviewed. With everything in one place, we focused on making Cases faster to work in – starting where the work begins.

The Search Bar Tools menu now includes Case Tools that puts your searches and blocks one click away. You can Pin a Case as your default, so you don’t interrupt your flow with every Finding. Alerts get the same treatment. A new Case Alert Group feature organizes your alerts by Alert Date, Tag, Search, or Criticality, and each group shows a summary, so you can decide where to start. When an investigation wraps up, Case Archiving separates Active and Archived Cases on the Cases home page, which keeps finished work out of the way.

Data Updates: Structured Leaks Arrive

Structured Data Leaks, now live in Vision, turn each leak into records you can query, filter, and read by field. Each record is organized into up to 40 attributes, with classification tags that help surface corporate, financial, identity, and device threats. The original headings from the source are retained and displayed alongside their data values, so context from the source file is not lost. Date options are richer as well, with both collected and posted dates available, and there are many more new features to explore.

Querying is sharper too. Username and alias searches now reach structured leak records, and they are especially powerful alongside other DarkOwl sources such as Forum Posts and Chat Messages when you are tracking actor activity. A handle that appears in a leak record can be followed to the forums and chats where the same handle is active.

Structured leak content is supported today in general search and the Search API, and more is coming. Customers can request beta access to our upcoming Leaks API, which will add enhanced query functionality and summarization features.

Market Analytics and Reporting

Darknet market data is most useful when it becomes a view you can act on. DarkMart™, DarkOwl’s structured collection of darknet marketplace content, gives us the listings, vendors, prices, and shipping details to build that view. This quarter we added the ability to turn it into intelligence reports. Product Category Reports go deep on a single category found on darknet markets, such as drugs, pharmaceuticals, or weapons. Top products with median prices, leading vendors, biggest movers against the previous period, pricing compared with the 12-month median, active markets, and shipping flows are all included. Activity and Trend Reports show markets that are new or going quiet, popular products moving across markets, pricing trends, emerging products and vendors, and geographic shipping trends.

Vision UI and Vision API Enhancements

Vision UI and the Vision API gained many new features this quarter. The updates below are a sampling:

Data Source Icons: We introduced a new search result layout with Visual Icons, making it easy to scan result types.

Usage and Activity Reporting: Usage metrics for Entity lookups, Translations, and Direct to Darknet launches now appear on the Activity page and in Usage Report downloads, so you can report a fuller picture of how Vision UI is used. For teams that use Vision API, the Usage API now supports filtering by date.

Data Leaks in Entity Explore and Entity API: Cryptocurrency, Card, and BIN entities in Entity Explore now include a Data Leak summary box, and Entity API returns data leak information in the response.

Collection Stats

Our data collection team continues to astonish us with the quantity of data made available across all DarkOwl products, including year over year growth for the number of email addresses, domains, credit card numbers, IP addresses, and crypto addresses.

Notable Content Collected

DarkOwl indexed a number of leaks attributed to ShinyHunters this quarter, and we are following the group closely. The victims span industries: healthcare and life sciences (Accord Healthcare, Lumenis), travel and retail (Carnival Corporation, Ralph Lauren, [JC Penney]), technology and communications (Fluke Corporation, American Tower Corporation), financial services (Abrigo, BOK Financial), and education and government (Houston City College, Moody Bible Institute, the Council of Europe). For recent activity from the group, read DarkOwl’s September 25, 2026 post, FBI Allegedly Hacked by ShinyHunters.

BOK Financial

Data purported to be from BOK Financial was posted on ShinyHunters on August 28, 2026. The post claimed 46 GB or more of data, and DarkOwl collected 48.3 GB. BOK Financial serves consumer, business, and wealth clients across the American Midwest and Southwest.

DarkOwl’s file tree analysis shows a large and varied collection that includes 848 JSON files, 707 HTML files, 398 SQL files, 76 Excel workbooks, 63 PDFs, 59 email messages, and 22 configuration files. Source code, API keys, and tokens appear among the exposed content, which makes this leak relevant beyond customer data: credentials and code give an adversary a path into systems as well as into records.

Police National Legal

Data purported to be from the Police National Legal Database (PNLD) was posted on ExfilSquad on August 3, 2026. According to the post, the leak contains 135,000 law enforcement contact records, including full names, email addresses, and police jurisdictions. DarkOwl indexed 135,065 records, which matches the claim.

PNLD has provided a legal database to the 43 Home Office police forces in England and Wales and the British Transport Police for over 30 years, and its customers include the Crown Prosecution Service and Trading Standards. In a public statement on August 2, 2026, PNLD acknowledged a July 26 cyber incident that exposed contact information of police staff, partner organizations, and public users. Contact records tied to police jurisdictions can support targeted phishing and social engineering of law enforcement personnel.

For more on the group that posted this leak, read DarkOwl’s August 6, 2026 analysis, ExfilSquad: A New “Data extortion group” Player Claiming High-Profile Breaches Across the US, UK, and Beyond. It also covers PNLD’s public confirmation of the incident.

Leaks of Interest

Council of Europe

Data purported to be from the Council of Europe (coe.int) was posted to the ShinyHunters data leak site in June 2026. According to the post, the group claimed to have exfiltrated 297GB of data across 429,000 files, from multiple Council of Europe divisions, including human resources, the Secretariat, the Parliamentary Assembly, and the European Directorate for the Quality of Medicines & HealthCare. Data exposed includes employee names, IDs, addresses, phone numbers, dates of birth, tax and social security information, and medical records, along with payroll and bank account information.

Carnival Corporation and Plc

Data purported to be from Carnival Corporation was posted by ShinyHunters, which listed Carnival Corporation on its “pay or leak” portal on April 18, 2026. According to the post, the leak contained 8.7 million records with 7.5 million unique email addresses and included fields indicating the data related to the Mariner Society loyalty program operated by Holland America Line. Data exposed includes names, dates of birth, email addresses, genders, geographic locations, and loyalty program details.

Police National Legal Database (PNLD)

Data purported to be from the UK’s Police National Legal Database was posted by the extortion group ExfilSquad, which listed PNLD on its leak site on July 26, 2026. According to the post, the group stole about 1.9 GB of data covering roughly 135,000 records, split between 114,000 PNLD subscribers and 21,000 Ask the Police users. Data exposed includes names, organizations, and work email addresses belonging to police officers, police staff, criminal justice professionals, government partners and customers.