Underground · what matters today

Filtración de base de datos de Vodafone 2026

Vodafone

A forum thread offers a Vodafone database leak dated mid-2026, a major global telecom operator. While the content could be significant, the post is roughly four months old, so it is not a fresh alert. It still matters for defenders tracking subscriber-data exposure across telecom providers.

Brecha de datos sanitarios de la empresa Woundtech

Woundtech

A raid forum thread advertises a fresh healthcare data breach at Woundtech, a US wound-care provider. Healthcare data is among the most sensitive, including patient identities and possibly medical records. Fresh medical leaks enable medical identity theft and targeted extortion, warranting immediate triage for defenders.

Base de datos de Phone House con más de 13 millones de registros

Phone House

A raid forum post published today offers a Phone House database of more than 13 million records. Phone House is a large European mobile-phone retailer operating in Spain and other countries, so the leak likely exposes customer names, contact details and purchase data. Such a volume is high-value for fraud, credential-stuffing and targeted phishing campaigns.

Filtración de datos de 7,5 millones de clientes de Momentum Telecom

Momentum Telecom

A forum database dump claims 7.5 million customer PII records from Momentum Telecom, a large US business-ISP and voice provider. The data appears fresh (posted the previous day) and typically includes names, addresses and contact details. Leaked telecom subscriber data fuels SIM-swap, phishing and account-takeover attacks, so it matters for defenders in the sector.

Filtración de historiales de pacientes del grupo portugués CUF

www.cuf.pt

A dataset of roughly 263,000 patient records from Portuguese healthcare group cuf.pt is being offered, including contact and demographic data. Health data is among the most sensitive categories, enabling targeted fraud and extortion. It is a confirmed named-organization healthcare leak worth surfacing.

Base de datos de clientes de Optum a la venta

Optum.com

A customer database attributed to Optum.com is being offered on the forum, indicating a leak at a major US healthcare services company. Healthcare customer data is highly sensitive and fuels medical fraud and targeted phishing. It is a sizable, named-organization leak worth surfacing to defenders.

Filtración de base de datos del Colegio Mexicano de Nutriólogos

colegiomexicanodenutriologos.org.mx

A database of roughly 584,000 records from colegiomexicanodenutriologos.org.mx is being leaked, containing personal and contact data. It affects a Mexican professional organization and its members, exposing PII usable for phishing and fraud. It is a LATAM-relevant leak worth tracking even if not government or critical infrastructure.

Venta de bases de datos del Ejército de Libia (gov.ly)

Libyan Army / Reconstruction Fund

A seller is offering databases belonging to the Libyan Army and the national Reconstruction Fund on gov.ly domains, indicating compromise of government and military systems. Such records can expose personnel, operational and institutional data. It is a high-impact state-target leak worth tracking even though it sits outside the LATAM region.

Filtración de datos del hospital Thye Hua Kwan (Singapur)

Thye Hua Kwan Hospital

A data collection linked to Singapore's Thye Hua Kwan Hospital (Ang Mo Kio) is circulating on BreachForums. Healthcare records are highly sensitive, so any leak of patient or staff data raises privacy and regulatory risks. The scale is unclear, so treat it as a possible breach to confirm with the affected organization.

Venta de herramienta para eludir verificación KYC bancaria

A seller on Cracked.st offers a KYC-bypass and document-forgery toolkit claiming to defeat major identity vendors including Sumsub, Onfido, Persona, Jumio, Idnow, Veriff and Ondato. This directly enables fraudulent account opening and money laundering at banks and fintechs relying on those providers. Defenders should expect forged onboarding attempts and tighten document and liveness checks.

Filtración de base de datos de la operadora Vodafone

Vodafone

A database attributed to telecom operator Vodafone is being distributed on the Spear Leaks forum, dated mid-2026, with a thread spanning nine pages. The size suggests a substantial dump of subscriber or corporate records. Because telecom operators are critical infrastructure, defenders should verify the data and prepare customer notifications and credential-reset plans.

Base de datos de IKEA a la venta en foro clandestino

IKEA

A forum user posted a claimed IKEA database for sale, indicating a possible breach or resale of the retailer's data. If authentic, it could expose customer or internal records usable for phishing, credential stuffing and account takeover. Given IKEA's global footprint it should be validated and monitored even though the source and scale are unconfirmed.

Base de datos con identidad completa de 596.652 ciudadanos mexicanos a la venta

Ciudadanos mexicanos (CURP / INE)

A threat actor is offering a full identity database of 596,652 Mexican citizens, including CURP, INE voter ID, home address and personal data. Government-issued identity records at this scale enable mass identity theft, fraud, loan/credit abuse and impersonation of voters. Defenders in Mexico and LATAM should treat this as a high-priority exposure and validate its authenticity.

Filtración de la base de datos de Artsy

Artsy

A database described as the Artsy online art marketplace has been posted in a forum leaks section. The scale and date are unclear, but a real company database leak can expose customer and account data used for credential stuffing. Worth verifying and adding to monitoring if confirmed.

Filtración de 21.145 cuentas de Binance

Binance

A database of roughly 21,145 Binance accounts is being circulated on a breach forum under a 2026 label. While the volume is modest, crypto-exchange credentials fuel account takeover, wallet draining and follow-on phishing. Exposed users should be flagged for credential rotation and monitoring.

Filtración de SCADA/BMS del hospital Thye Hua Kwan de Ang Mo Kio

Thye Hua Kwan Hospital (Ang Mo Kio, Singapore)

A collection labeled as the Building Management System (BMS) and SCADA system of Ang Mo Kio–Thye Hua Kwan Hospital in Singapore has been posted on a breach forum. If authentic, it exposes operational-technology data controlling building systems in a healthcare facility, a critical-infrastructure setting. Defenders should treat it as a possible OT-access vector and verify whether the data is genuine and current.

Filtración de datos de empleados de McDonald's India

McDonald's India

A database of McDonald's India workers was leaked and made available for download, exposing staff personal data. Such records enable identity fraud and targeted phishing against employees. The post dates to 2025, so it is not a fresh alert, but the data may still be reused against affected individuals.

Filtración de datos de Systech USA publicada en DarkForums

Systechusa.com

A dataset from Systech USA was published on DarkForums for free download, exposing internal company data. Although the exact scale is unclear, leaked corporate data fuels fraud and follow-on intrusions. It is worth tracking for credential reuse and possible supply-chain exposure.

Filtración de 327.000 contactos del portal jordano Akhtaboot

akhtaboot.com

A 327k-record database from the Jordanian job portal Akhtaboot is circulating, exposing professional contacts and likely account data. Recruitment portals are prime targets for targeted phishing and BEC. Affected organizations and users should be warned and credentials reset.

Filtración de datos de pacientes de Alles Lægehus/We.Care (Dinamarca)

Alles Lægehus / We.Care

A dataset exposing 150k+ patient and employee records from the Danish healthcare group Alles Lægehus/We.Care has been posted. Health data is highly sensitive and regulated, raising extortion and GDPR exposure. Defenders should watch for credential reuse and targeted phishing against clinical staff.

Base de datos de 850 millones de usuarios de China Mobile a la venta

China Mobile

A database with over 850 million unique China Mobile subscriber records is being offered via a carding forum, one of the largest telecom leaks seen. Names, phone numbers and related PII at this scale enable SIM-swap, phishing and account-takeover campaigns. Defenders in telecom and fraud teams should treat it as recycled PII/credential material driving downstream attacks.

Presunto atacante expone brecha de datos de Pathao (Bangladesh)

Pathao

An actor published a message addressed directly to Pathao management about what they call a "partial data breach", implying a database dump, extortion or a follow-up leak of the Bangladeshi super-app. Pathao runs ride-hailing, food delivery and payments for millions of users, so any customer data exposure can fuel fraud and credential-stuffing across the region. Even though the scale is unconfirmed, defenders should verify exposure and watch for the data being published or sold on the same forum.

Filtración de base de datos de donaciones de la Cruz Roja Mexicana

Cruz Roja Mexicana

A dataset of roughly 46,670 donation records tied to the Mexican Red Cross is being offered for sale on DarkForums. It includes donor personal and payment-related data from a humanitarian organization in LATAM. Donor lists are valuable for phishing and financial fraud, so the entity should be alerted to validate and disclose the breach.

Base de datos de clientes de Wells Fargo a la venta

Wells Fargo (EE. UU.)

A DarkForums listing claims to share a full Wells Fargo customer list, targeting a major US bank. Large-bank database sales are often recycled or fraudulent, but if legitimate the impact on identity theft and downstream fraud is severe. Worth tracking and validating the sample before acting.