Insider threat report tracks 857 unique posts seeking or offering access

What happened

Flashpoint identified 857 unique insider-related posts across online forums and chat networks in September 2026, according to its report published on 15 October. Much of the activity involved attempts to recruit employees or advertise access that could support fraud.

The intelligence company, which published the original analysis, recorded 9,787 insider-related posts overall, involving 1,216 channels and 1,778 authors. That broader collection included recruitment approaches, service advertisements and general discussion of insider activity.

These figures describe online communications, not confirmed breaches or a count of employees involved in wrongdoing. Flashpoint said its analysts could not independently establish whether the recruitment and advertising claims were genuine.

Most unique posts appeared in English-language Telegram channels that the company described as mid-tier. Although the report covers dark web recruitment, its findings therefore extend to encrypted messaging networks rather than dark web forums alone.

Retail had the highest number of unique posts among identifiable industries, with 135. Telecommunications followed with 116, financial services with 85 and technology with 83. Together, those sectors accounted for 419 posts, or nearly 49% of the unique total.

The report also recorded 41 public-sector posts, three concerning healthcare and two concerning media. However, analysts could not identify the targeted organisation or industry in 45.7% of unique posts. The narrative describes that group as unknown, while the accompanying table labels 392 posts as other.

Flashpoint said observed activity had declined, but the report’s written findings do not provide a comparison figure or percentage fall. The available figures should not be read as establishing a corresponding reduction in successful insider attacks.

The background

The report distinguishes between two routes to insider-assisted activity. In recruitment, an outside attacker approaches someone with legitimate workplace access. In advertising, an employee or contractor offers that access or related services to potential buyers.

Such arrangements can support the theft of sensitive information, the installation of malicious software, account compromise or fraud. Flashpoint includes SIM swapping among the possible uses: transferring a phone number to another SIM so that someone else can receive its calls or messages.

The common feature is the misuse of permissions already granted for work. An attacker who gains help from an authorised employee may not need to defeat the same technical barriers as someone trying to enter a system from outside.

Flashpoint selected 15 recruitment and advertising posts as notable examples from September. Nine involved attempts to recruit insiders and six offered insider services. Telecommunications accounted for five examples, retail and technology for three each, and financial services and the public sector for two each.

That selection is separate from the full set of 857 unique posts. Its nine-to-six split does not establish the balance between recruitment and advertising across all the activity the company collected.

Repeated solicitations also appeared across multiple discussion threads, often with little information about the access available. This limits what organisations can infer from an advertisement without further evidence linking it to a real employee, account or system.

The report opens with an illustrative scenario in which an administrator accepts cryptocurrency to approve an authentication request. It does not present that scenario as a documented incident, so the payment and outcome should not be treated as findings from the September dataset.

The focus on willing collaboration addresses one part of a wider insider-risk problem. As earlier Microsoft guidance on insider risk management explains, organisations also face accidental disclosures and compromised accounts, which require different judgements about employee intent.

What people are saying

Flashpoint attributes the concentration in retail, telecommunications and financial services to attackers’ interest in staff who can enable fraud, reach customer accounts or misuse workplace permissions. Its analysis focuses on the value of legitimate access rather than only on technical vulnerabilities.

The company says internal security controls alone can struggle to detect this activity because it uses valid credentials. It argues that relying exclusively on internal records can leave security teams discovering a problem only after information has been taken or systems damaged.

Flashpoint’s guidance recommends looking outside the organisation for employee solicitations, references to corporate domains and recruitment attempts. It says its collection system monitors dark web forums, illicit marketplaces and underground chat networks.

The publisher also recommends tracking stolen credentials and active session tokens, which can allow access to an already authenticated account. For internal investigations, it identifies unusual downloads, access outside normal working hours and unauthorised software installation as behaviours worth examining.

What happens next

Flashpoint describes the publication as a monthly report intended to track recruitment, access advertising and related tactics. It does not announce an investigation into a named employer, a prosecution or a confirmed compromise arising from the September posts.

For organisations assessing a possible match to their workforce, the unresolved issue is whether an online claim corresponds to genuine access. A solicitation is evidence of an approach or stated interest, not proof that an employee accepted it; an advertisement is not proof that the seller can deliver what is offered.

Any workplace response also needs a clear process for handling sensitive employee information. Earlier CISA guidance on insider threat management teams recommends involving security, human resources, legal and operational specialists, with safeguards for that information.

Future comparisons will need to keep total communications, unique posts and selected examples distinct. Those measures describe different aspects of the monitored activity and cannot, on their own, establish how many organisations were successfully targeted.