Underground · what matters today

Credenciales de usuarios de CLARU Perú publicadas en DarkForums

CLARU Perú

A DarkForums actor using the handle z4p3r0c0 posted a set of user accesses for CLARU Perú on 5 November 2026. Although the volume is not stated in the snippet, leaked account credentials for a Peruvian service let attackers attempt account takeover and credential stuffing against linked platforms. Peruvian organisations and customers of the platform should treat these credentials as compromised and rotate them.

Datos de alumnos de 19 escuelas primarias de la Secretaría de Educación de México en venta

Secretaría de Educación (SEED) México

A DarkNetArmy post by SUB-ZER0 claims data from 19 primary schools under Mexico's Secretaría de Educación, covering minors, and was published today. Records tied to children carry an elevated duty of care: names, school affiliation and guardian contacts are highly sensitive and enable extortion, bullying and identity fraud. Educational authorities in the region should treat this as a serious breach given the vulnerable population involved.

Base de datos de 125.000 contribuyentes del gobierno de Coahuila, México, a la venta

Gobierno de Coahuila (México)

Under the handle SUB-ZER0, a listing on DarkNetArmy offers a database of roughly 125,000 contributors tied to the Coahuila state government in Mexico, published and bumped today. Taxpayer and contributor records typically include names, identifiers and contact data that enable identity theft and targeted fraud. Because the data is tied to a specific state government, it also provides credible pretext material for phishing campaigns impersonating Mexican tax authorities.

Base de datos del Gobierno de Colombia publicada en DarkForums

Gobierno de Colombia

A DarkForums user (Krezqatorn) posted what is presented as a Colombian government database on 5 November 2026, suggesting a fresh exfiltration of public-sector records. The exact agency and record count are not disclosed in the listing, which raises the risk that citizen, tax or registry data is being circulated. Any leak of national government data in Colombia exposes citizens to identity fraud and gives attackers material for credential and social-engineering campaigns against public entities.

Base de datos de clientes de Phonehouse España a la venta

PhoneHouse España

A consumer database attributed to the Spanish electronics retailer Phonehouse.es was posted for sale on DarkForums by user WSdatabase as a '2026' dataset. Customer records like these fuel phishing and account-takeover campaigns against Spanish consumers. Phonehouse and Spanish defenders should assess authenticity and notify affected customers.

Venta de datos de ciudadanos argentinos con DNI y correo electrónico

A seller on DarkForums is offering leads of Argentine citizens combining national ID (DNI) numbers with email addresses. DNI is a core identity document in Argentina, making the data valuable for account takeover and social engineering. Organizations serving Argentine users should watch for identity and credential abuse.

Filtración de base de datos del gobierno de São Paulo, Brasil, con 200.000 registros

Gobierno del Estado de São Paulo (SP.GOV)

A 200,000-record database tied to the São Paulo state government (SP.GOV) was published on DarkForums including names, CPF, phone numbers and emails. CPF is Brazil's national taxpayer ID, so the leak raises identity-theft and fraud risk for affected citizens. Brazilian public-sector teams should confirm the exposure and monitor for misuse of the data.

Filtración de base de datos del gobierno de Coahuila, México, con 2 millones de registros

Gobierno del Estado de Coahuila

A database attributed to the Mexican state government of Coahuila, reportedly around 2 million records, was posted for download on DarkForums by user SUB-ZER0. Citizen data at this scale can enable identity fraud, phishing and targeting of state services. Mexican public-sector defenders should verify the claim and watch for leaked personal records.

Base de datos de Serasa Experian (Brasil) publicada con enlace de descarga

Serasa Experian

A user on DarkForums (Olyndakron) has republished a Serasa Experian Brazil database with a working download link. Serasa is Brazil's largest credit bureau, so any dataset of consumer credit and identity records carries very high sensitivity. The content may be a re-post of an older breach, but given the scale and financial-sector impact it still warrants verification by Brazilian defenders.

Filtración de 3,6M de registros de negocios y transacciones de IziPay Perú

IziPay (izipay.pe)

A dataset advertised on DarkForums claims to contain 3.6M+ business and transaction records from IziPay, a Peruvian payment gateway. If genuine, this exposes merchant identities and payment/transaction metadata for a large share of Peru's card-accepting merchants. Payment-processor data is high-value for follow-on fraud and poses real risk to Peruvian financial-sector defenders.

Base de 6 millones de móviles alemanes con fecha de nacimiento

DarkForums user Tazrozen posted 6 million German mobile numbers with dates of birth on 31 Oct 2026. This combination of identifiers enables SIM-swap, smishing and KYC bypass against real users. German telecoms and any service relying on SMS OTP for these subscribers should assess exposure and strengthen verification.

Filtración de 82 millones de direcciones de Yuantong Express

Yuantong Express (yto.net.cn)

An 82-million-record set of addresses and customer data from Chinese courier Yuantong Express (yto.net.cn) was posted on DarkForums on 5 Nov 2026. Parcel data exposes home addresses, phones and purchase patterns, enabling fraud and physical-risk targeting. Chinese logistics firms and e-commerce customers should treat these records as compromised.

Filtración de 5 millones de clientes del ISP turco Turknet

Turknet

DarkForums user ReichLeaks posted a 5.05-million-customer dataset from Turkish ISP Turknet on 5 Nov 2026, tagged as a re-hack. Telecom subscriber data enables SIM-swap, targeted phishing and account takeover for millions of users. Turkish ISPs and Turknet customers should verify the claim and prepare credential and notification responses.

Filtración de 7 millones de datos de clientes de Santander México

Santander México

A 7-million-record Santander Mexico dump was re-shared on DarkForums on 5 Nov 2026 with a 'new link', meaning the data keeps circulating freely despite being an older leak. Banking PII at this scale fuels account takeover, phishing and card fraud across Mexico. The bank and its customers should assume the data is public.

Base de datos del Gobierno de Colombia publicada en DarkForums

Gobierno de Colombia

DarkForums user Abrtodor posted a 'Colombian Government Database' on 5 Nov 2026 for download, without naming the agency or record count. If authentic, it exposes citizen PII held by a state body, enabling identity fraud and phishing against public employees. Colombian public-sector teams should verify exposure and hunt for reuse.

Base de datos de 70 millones de AT&T ofrecida a la venta

AT&T

A DarkForums post by user Abrtodor claims an AT&T database of 70 million records on 5 Nov 2026, but this closely matches the well-known 2024 AT&T breach and appears to be a recycled repost rather than new theft. It matters only as a reminder that such telecom customer data keeps circulating in criminal markets. Treat it as stale unless new fields or sample records prove otherwise.

Filtración de documentos confidenciales de un notario de Bucarest

Notar-Bucuresti.ro

A thread on NulledBB claims a leak of private and confidential documents from the Romanian notary office Notar-Bucuresti.ro. Notaries hold sensitive legal, identity and property records, so exposed files raise serious privacy and fraud concerns for clients. Defenders should verify scope and warn affected individuals about identity-theft and document-fraud risk.

Ransomware 'pear' publica al fabricante Bridgestone HosePower

Bridgestone HosePower, LLC

The ransomware group 'pear' added Bridgestone HosePower, LLC to its leak site, a US manufacturer and distributor of hydraulic and industrial hose products. A fresh victim listing signals likely data theft and operational disruption in a manufacturing supply chain. Defenders in industrial manufacturing should treat this as a supply-chain risk and review expose data dependencies.

Filtración de datos del bróker AvaTrade en España

AvaTrade

A database tied to the online broker AvaTrade was posted on DarkForums by user Nympaxor on 5 Nov 2026. Because the target is a regulated financial services firm, exposed client identity and KYC data could enable account takeover, targeted phishing and fraud against investors. Defenders in Spanish-speaking finance should validate the dataset and warn customers to watch for credential-stuffing and impersonation.

Venta de datos de clientes del exchange Swyftx (Australia)

Swyftx

The seller 'LeadsHouse01' is advertising a 'Swyftx Crypto Data 2026' dataset on DarkForums, referring to the Australian cryptocurrency exchange Swyftx. Although the listing gives no record count, a fresh 2026 customer dataset from a regulated exchange typically includes identity, contact and holdings information valuable for phishing and account takeover. Crypto users are prime targets for wallet-draining scams, so exposure should be treated as an active fraud risk rather than a generic leak.

Filtración de 31 GB del Poder Judicial de Lima Norte, Perú

Corte Superior de Justicia de Lima Norte

The user 'Prymutir' published on DarkForums a 31.10 GB archive attributed to the Superior Court of Justice of Lima Norte, a Peruvian judicial body that handles criminal, civil and family cases. At that volume the dump likely contains case files, filings and personal data of litigants, employees and possibly judicial operators. A leak of a national judiciary is a high-value target for extortion, doxxing and follow-on fraud against citizens, and it is a direct reputational and legal risk for the Peruvian state.

Filtración de 3,46 GB de datos de Taiwán publicada en foro

A 3.46GB archive labeled as a Taiwan data leak was published on DarkForums by a user. The listing does not detail the affected organization, but a leak of this size can hold personal or organizational records useful for fraud and intrusion. Taiwanese organizations should review it for exposure.

Supuesta filtración de 200 millones de credenciales de X (Twitter)

X (Twitter)

A DarkForums post by Vorjikin claims a 200 million-plus email:password dataset tied to X (Twitter). Credential dumps of this type are often recycled from earlier breaches but still enable account takeover and phishing at scale. X users and security teams should rotate passwords and confirm MFA.

Filtración de datos del proveedor sanitario Solventum (3M)

Solventum

A threat actor using the SeraphimGroup handle posted a data breach thread for Solventum, the healthcare company spun off from 3M, on DarkForums. Stolen medical-sector data raises risks of fraud and targeted phishing against patients and partners. Healthcare defenders should assess exposure and prepare notifications.