DaOnlySparkThreat actor
DaOnlySpark is a forum actor claiming to have leaked sensitive data from AdvaCare, including internal financial details, and from Jinko, comprising 3.7 GB of patient records, clinical profiles, and private messages. Both claims remain unverified.From MISP Galaxy
Last reported 15 days ago, by Dark Web Informer2 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1213Data from Information Repositories
“Data from Information Repositories: Databases”
- T1213.006Databases
“T1213.006”
- T1078Valid Accounts
“T1078”
- T1552.008Chat Messages
“The claimed contents include 50,649 user accounts, 784,081 private chat messages, identity-verification records, financial data and bcrypt password hashes.”
- T1589.001Credentials
“T1589.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Moveciti Administrator Access and Exported Database Offered for Sale With 1.18 Million Bus-App Documents“An actor using the handle "DaOnlySpark" claims to be selling administrator access to Moveciti's database along with a database export dated October 9, 2026.”
-
Alleged Kaya Leak Includes 1.7 Million Records and Identity Data“An actor using the handle "DaOnlySpark" claims to have breached Kaya and released a 1.14 GB dataset containing 1,697,095 records across 87 collections.”
Thanks — we review every report.