Provenance Record

Clear, well-structured News piece (619 words, within the 400-1200 range). Sensible Overview / What We Know / What We Don't Know / Analysis structure. Technical depth on infostealer logs is accurate and well-sourced. Neutral framing throughout.

All four source snapshots read from disk and verified. source-0 (SC Media, status 200): confirms 24B records, plaintext usernames/passwords/login URLs, Cybernews discovery, Elasticsearch, ~8 TB, 36 sources (Telegram channels / prior breach collections / data exported from live servers), 260M records linked to defunct ransomware group Darkside Telegram channels, owner unidentified with English/Russian mix and regular updates, account-takeover risk especially without MFA. source-1 (Malwarebytes, status 200): confirms 8.3 TB, 24B records, 36 sources, Cybernews, full infostealer-log contents (passwords across browsers, session cookies/tokens bypassing MFA, autofill, device fingerprints, crypto wallets, messaging accounts), 1.7B from hacking-related Telegram channels mainly English and Russian, Elasticsearch cluster, 'mother of all breaches' nickname, mega-dump comparison, and the check-exposure/change-passwords/no-reuse/enable-MFA guidance. source-2 (Israel Defense, status 200): confirms 24B records, 8.3 TB, discovered June 12 2026 / secured June 15 2026, RedLine stealer, plaintext passwords + login URLs, 36 sources, 22.6B from unidentified 'collections', CVE records / GitHub links / news articles / social media posts, threat-intelligence-or-breach-monitoring suspicion, exposure caused by misconfiguration during a temporary migration. source-3 (Cybernews, status 200 via Archive.org fallback): confirms 24B records, 8.3 TB, June 12/June 15 timeline, 22.6B collections, Darkside Telegram channels, and that the comparable 2024 Cybernews 'supermassive leak' held over 26 billion records. Every load-bearing claim (headline 24B/8.3 TB, summary, Overview lead) is independently carried by at least one fetchable non-Cybernews outlet (SC Media, Malwarebytes, Israel Defense); no load-bearing claim rests solely on the Archive-fallback Cybernews snapshot.

All numbers, dates, names, and the IronWorm internal cross-reference verified. One misattribution found (recoverable, filed as a correction): the article writes '[Malwarebytes] noted that a previous incident dubbed the mother of all breaches held 26 billion records.' The Malwarebytes snapshot uses the phrase 'mother of all breaches' but does NOT state the 26 billion figure (it attributes that earlier dump to Leak-Lookup without a record count). The 26-billion figure traces to the Cybernews source (its 2024 'supermassive leak' of over 26 billion records). The fact is true and cited elsewhere in the article's source set; only the specific outlet attribution is wrong. The internal /article/2026-06/15-ironworm-... cross-reference resolves to an existing published article.

Substantively accurate, well-sourced, neutral News piece with one recoverable misattribution (the 26-billion figure cited to Malwarebytes instead of Cybernews). Every headline/summary/lead claim is independently sourced. APPROVE_WITH_CORRECTIONS: publish with a corrections record documenting the misattribution.