☑️ Weekly Darkweb – February Week 1, 2026

🔍 French Aviation Safety Firm O’s Internal Data for Sale on Dark Web

• On January 31st, a post advertising the sale of internal data from French aviation safety firm O was identified on the dark web hacking forum ‘BreachForums’.

  ✓ O is a subsidiary of A, a global industrial safety firm based in France, and performs public aviation safety duties commissioned by the French Civil Aviation Authority.

• The seller claims to have obtained a total of 420GB of data, including 90,000 customer support records and 10,000 user email lists and various attachments. The leaked files reportedly include partnership documents related to three global aircraft manufacturers and French national airline, government agencies email lists, and sensitive documents such as passports and IDs.

• According to S2W user profiling, the threat actor 'LAPSUS –GROUP' has uploaded six posts related to French government and educational institutions since late December 2025.

🔍 Taiwanese Paper Manufacturer L’s Confidential Data Leaked on Dark Web

• On February 1st, a leak containing confidential data from Taiwanese paper manufacturer L was spotted on the dark web hacking forum ‘DarkForums’.

  ✓ L is a publicly traded company on the Taiwan Stock Exchange, with an annual revenue of approximately USD 1.4 billion in 2024.

• The threat actor claimed that after a failed ransom negotiation following an encryption attack on L’s servers, they proceeded to leak the data via a file-hosting service.

• The leaked 5.6GB compressed file reportedly contains sensitive data, including blueprints, non-disclosure agreements (NDAs), quotes, and customer emails.

🔍 Japanese Machinery Manufacturer H at Risk of Data Leak via Everest Ransomware

• On February 1st, Japanese industrial machinery manufacturer H’s internal confidential data was found to be at risk of leakage by the ‘Everest’ ransomware gang.

  ✓ H is a global entity with subsidiaries in the US and Europe, recording annual revenues of approximately USD 500 million as of 2025.

• The ransomware gang claims to have exfiltrated 30GB of data and posted screenshots of 12 confidential documents, such as system designs and user account lists, as proof. The negotiation deadline is set for February 12th.

*The full report is available upon request and for XARVIS subscribers.