This lab uses public incident reporting and sanitized synthetic artifacts for defensive OSINT training. Real incidents are referenced for educational context only. The interactive data is fictionalized and must not be used to identify, contact, expose, or accuse real people.
Mirror Leak Channel
Test whether a Telegram channel claiming a 'full database dump' of a hospital breach is genuine, by comparing post timing, file hashes, and the official disclosure record.
Good. The fake-mirror pattern is well documented in public breach reporting; every entity and indicator in this scenario is fictional.
Incident Brief & Analytical Mission
The fictional Harbor Medical Group publishes an official breach notice at 12:00 UTC. Fifteen minutes earlier, a brand-new Telegram channel called 'harbor_leak_mirror' posts a 'FULL DATABASE' claim with sample file names. This mirrors a recurring real-world pattern: after (or just before) genuine breach announcements, opportunistic channels appear claiming to sell or mirror the 'full dump', often recycling files from older, unrelated breaches to run scams or phishing. All organizations, channels, file names, and hashes in this case are synthetic.
Establish the exact ordering of the fake channel's activity against the official disclosure, evaluate whether any evidence supports a real leak, draft a four-point defensive communication note for the victim organization, and assess the actor's most likely motivation.
Official Disclosure vs Fake Channel Activity
Minute-level reconstruction of 9 April 2025 (UTC). Times come from platform metadata and the official notice.
A local journalist tweets that Harbor Medical Group has scheduled a 'security statement' for noon.
Telegram channel 'harbor_leak_mirror' is created. Zero prior history.
First post: 'FULL DATABASE of Harbor Medical - 2.1M patients' with three sample file names. No samples of actual data.
Harbor Medical Group CISO publishes the official notice: limited access to a scheduling system, investigation ongoing, no evidence of database exfiltration.
Analysts match the channel's file hashes to a 2023 breach of the unrelated 'Old Coast Clinic'; none appear in Harbor Medical's environment.
Investigative Checklist Tasks
- 01
Determine from the timeline whether the fake channel became active before or after the official disclosure, and what public signal it most likely reacted to.
- 02
Assess whether any artifact supports the 'real full-database leak' claim, citing the hash comparison.
- 03
Draft a four-point communication note for Harbor Medical Group written in defensive, non-speculative language.
- 04
State the actor's most likely motivation (extortion, attention, or scam/phishing) and support it with evidence from the artifacts.
Evidence Notebook
Use this panel to log individual threads of evidence. Your entries are saved locally in this browser only.
No evidence records logged yet.
Report Drafting Board
# CSINT Incident Lab Report ## Research Question Is the 'harbor_leak_mirror' channel distributing genuine data from the Harbor Medical Group incident, and how should the organization respond? ## Summary No analyst summary provided yet. ## Fact - No forensic facts recorded in the notebook. ## Signal - No analytical signals logged. ## Inference - No alternative explanations recorded. ## Recommendation - No next-pivot recommendations recorded. ## Confidence Low ## Limitations No limitation notes entered. ## Source reliability Not assessed. Annotate each source with its reliability tier before publishing. ## Information validity Not assessed. Confirm whether each item is directly observed, reported, or inferred. ## Missing context Not recorded. List what data is missing or could not be verified from public sources. ## Next safe steps - No next safe steps specified. ## Sources used - No source references listed. --- Generated at: 2026-07-24T18:30:26.411Z