[xpl0itrs]

On March 25th 2026, we co-operated with TeamPCP & Vect Ransomware to obtain access to Sportradar through a supply chain attack against Trivy. Sportradar AG has a market capitalization of $4.98 Billion. 

---

We have access to a lot of stuff, but what I want you to focus on is the customer records, FIBA credentials, Bet365 (which is a separate company) credentials, database passwords, and all the other PII data we are offering for sale on this fine evening.
Pricing:
All Data: $50k USD
User Data + PII: $7,500 
(uman_db_dump_20251209_133310.sql.gz, uman_db_export_20251205_153512.zip - all logs, etc)
Pivot/IA Info (api keys, oauth client/secret pairs, other service data) only is $5k USD
Tox:  300B2D5FD09996D9DCFD714A3E7C0059EF70825AF78ED544880DC9990EBF9859B798CC8F2B03
Session:  05c8ae06e40a63cfd94d3307a3461ca668aa88bb18686083d6927e969249501075

---

overview: 
ibb.co/6JcVFKDj 
ibb.co/twVNch4Y
ibb.co/nNvKQckD
embedded at bottom

---

~26,000 Users with PII Exposed
~2,700 Unique Emails (in just Users table)
Data of 23,169 sports persons with gender, date of birth, full name, and nationality
59 named business contacts with direct email addresses and some phone numbers
`customers` table (SQL dump + CSV), 161 orgs (59 with named contacts, Contact name, email, phone, technical contact name/email)
8 production RDS database passwords with full endpoints
5 Auth0 OAuth client ID/secret pairs (tenant: atriumsports.eu.auth0.com) 
2 Kafka SASL credentials
1 New Relic NRAK access key + 12 synthetics monitoring tokens 
1 Sports Media API key (from HashiCorp Vault) 
5 application secrets from Terraform state
12 unique TV Graphics/Unified Odds API keys
All 328 platform API key/secret pairs - every single one listed with description and expiry
Notable third-party integrations identified from credential descriptions (ESPN, Nike, NBA Asia, IMG
  Arena, etc.)
Kafka SASL Credentials
JavaScript Source Maps
Full API Documentation
CloudFront Access Logs with Client IPs
Additional Exposed Infra:
- VPC IDs, subnet IDs, security group IDs
- RDS endpoint hostnames and ports
- MSK (Kafka) broker endpoints
- ElastiCache (Redis) endpoints
- CloudFront distribution IDs
- Lambda function ARNs
- API Gateway IDs
- IAM role ARNs and policies
- ACM certificate ARNs
- Route53 zone IDs
Passwords (plus Auth0) for the following services (prod):
CMAN (Competitions Manager) RDS
PMAN (Permission Manager) RDS Aurora MySQL
TMAN (Tournament Manager) RDS Aurora
RANK RDS
EVO RDS
UMAN (User Manager) RDS
(root to all, they have improper perms)
Exposed Auth0 Secrets:
CMAN (Competitions)
PMAN (Permissions)
TMAN (Tournaments)

---

prod_pm.users — userId, userCode, name, active
[*]prod_pm.user_fixtures — user-fixture assignments
[*]prod_pm.ratings — fixture ratings with user names, venues, comments
[*]prod_pm.cue_log — action log with user IDs
[*]prodproductionmonitor.* — mirror of same tables (larger scale)*

[*]

---

sample:
authId: auth0|5d833711379fad0dfc0c9513
name:  maxim.vandermeulen@keemotion.com
email:  maxim.vandermeulen@keemotion.com
authId: auth0|5db74306063aef0cb3cd38b2
name:  rob.flude@australia.basketball
email:  rob.flude@australia.basketball
authId: auth0|5e67eff55122a50cf73eae34
name:  dean.anglin@nbl.com.au
email:  dean.anglin@nbl.com.au
Scorebird — Contact: Ian Woodward-Smith ([email=ian@scorebird.com]ian@scorebird.com[/email])
NBL1 — Contact: Dean Anglin ([email=dean.anglin@nbl.com.au]dean.anglin@nbl.com.au[/email])
CBB (Brazil) — Contact: Alex Oliveira ([email=alex.oliveira@basquetebrasil.org.br]alex.oliveira@basquetebrasil.org.br[/email])
Taiwan Basketball — Contact: Ryan Tan ([email=ryan.tan@infrontsports.com]ryan.tan@infrontsports.com[/email])
El Salvador — Contact: David Diaz ([email=cazun73@yahoo.com]cazun73@yahoo.com[/email])
Sports Person Sample: 
personId, gender, dob, nationality, status, nameFullLocal
a71566d4-4bf6-11ec-a110-8ec538e495e1, MALE, 1900-01-01, BRA, ACTIVE, A B
9bfed004-2082-11ec-82e8-120e8a6700ce, MALE, 1900-01-01, ---, ACTIVE, Abelardo Junior
92dbc935-59b7-11f0-b00a-914e63afef48, MALE, , BRA, ACTIVE, Abel Carvalho Baptistella
Terraform State Files
competitions-terraform-states-backend-prod
sdsi-terraform-states-backend-prod
rank-terraform-states-backend-prod
pman-terraform-states-backend-prod
tman-terraform-states-backend-prod
evo-terraform-states-backend-prod
synthetics-monitoring-terraform-states-backend-prod
evo-time-machine-terraform-states-backend-prod
eui-terraform-states-backend-prod
dc-dqp-terraform-states-backend-prod
uman-terraform-states-backend-prod
dc-mapi-terraform-states-backend-prod
eui-terraform-states-backend-prod
gitlab-runner-terraform-states-backend-prod
dc-internal-tools-terraform-states-backend-prod
pm-terraform-states-backend-prod
dc-dev-web-terraform-states-backend-prod
dc-dev-web-terraform-states-backend-prod
admin-comp-terraform-states-backend-prod
stats-terraform-states-backend-prod
admin-dc-terraform-states-backend-prod
commentary-terraform-states-backend-prod
nr-cw-integration-terraform-states-backend-prod
api-tools-terraform-states-backend-prod
CSV Files:
uman_db_export/
uman_db_export/tmp_organizations.csv
uman_db_export/DATABASECHANGELOGLOCK.csv
uman_db_export/user_linkages.csv
uman_db_export/plans.csv
uman_db_export/users.csv
uman_db_export/DATABASECHANGELOG.csv
uman_db_export/customers.csv
uman_db_export/credentials.csv
uman_db_export/customer_products.csv
uman_db_export/products.csv
uman_db_export/applications.csv
uman_db_export/permissions.csv

---

embedded images: