-
A seller claims to hold 470,000 UK customer records with names, home addresses, phone numbers, and email addresses.
-
The records carry an October 19, 2026 date, and one buyer can reportedly get them for $900.
-
Nobody has confirmed the records are real or named the company they came from.
A seller on a dark web market says they hold the personal details of 470,000 UK customers. The asking price is only $900 for the whole set. Reports say the claim first spread through a post on X.
Nobody has proved the claim so far. No one has named the company that supposedly lost the data.
Seller Offers 470,000 UK Records to a Single Buyer
A dataset with 470,000 UK customer records has reportedly appeared for sale on an underground market. A dark web market is a hidden online place where people trade stolen or illegal items. The listing has raised fears that criminals could misuse the personal details. Still, nobody has shown where the records came from or whether they are real.
The cybersecurity account Dark Web Informer shared the claim on X. According to the post, the records include full names, home addresses, mobile phone numbers, and email addresses. The post also mentions other profile details. The seller described the data as previously unused and dated it October 19, 2026.
The seller plans to offer the set to one buyer only. That buyer would pay $900. The post does not name any company, group, or service provider as the source of the records. It also does not say whether 470,000 different people appear in the set. Some entries could be repeated.
The claims also leave out how the seller got the data. It might come from a security breach, data scraping, or older databases that already circulated online. The posts show no proof that anyone has checked the records against real customer lists.
Low Price Draws Attention from Online Observers
Another account, The Doxx Doctor, also commented on the claim. The account stressed that the report remains unverified. It also pointed to the low price. At $900 for 470,000 records, each record costs about $0.0019. That equals roughly one-fifth of a US cent per person, if every record belongs to a different person.
The price alone cannot prove the data is real or complete. It also cannot show how much the data is worth. However, accurate contact details could help criminals in several ways. They could send targeted phishing messages, which are fake messages that trick people into sharing private details. They could also make scam calls or pretend to be someone else. Experts call these tricks social engineering.
A message that includes your real name or home details looks more believable than a generic scam. Criminals could pose as delivery companies, banks, service providers, or government offices. They could then try to make people share more information or send money.
Cyber threats against the UK also extend beyond data exposure, with Russian hackers threatening black screens and empty bank accounts in a separate reported campaign.
The UK has already seen confirmed leaks of personal data. In May 2026, the Information Commissioner’s Office reported that a cyberattack on South Staffordshire put the details of 633,887 people on the dark web. That case is separate from the new claim. Nothing links the two.
Proof Still Missing as Safety Advice Continues
At the time of writing, the sources reviewed have not confirmed the claim about 470,000 records. No reliable public evidence names the seller or the affected company. Nothing shows where the data first came from. Nothing proves the advertised records are genuine.
The National Cyber Security Center gives advice after data exposure incidents. It tells people to watch for suspicious messages. It also warns them not to click links in unexpected messages. The center suggests using strong, separate passwords for each account. It also recommends two-step verification to protect accounts.
UK residents can take simple steps without assuming their details sit in this set. They should be careful with unexpected calls, texts, and emails that use personal details to earn trust. They should check any request through official channels before sharing sensitive information.
Until more proof appears, people should treat the sale as a dark web claim, not a confirmed breach. Independent checks must show whether the records are real. They must also show whether any company or group of customers has been affected.
