BRIEFLeakhighP56
17 million US Instagram profiles scraped via API offered for sale
Instagram (EE. UU.)
Detected6 November 2026 · 15:43 UTC
A seller on DarkForums is offering a 17 million record dataset of US instagram.com accounts obtained through API scraping, dated 2026. While it likely contains profile and contact metadata rather than credentials, at this scale it fuels targeted phishing, SIM-swap pretexting and account-takeover attempts against high-profile users. Defenders should treat exposed emails and phone numbers as compromised identifiers.
CategoryLeak
Severityhigh
Priority score56
Detected6 November 2026 · 15:43 UTC
LeakPriority 66
Filtración de 120,7 millones de registros del sector educativo de São PauloA dataset labelled 'Brazil SP EDUCATION' with 120.7 million records was published on DarkForums, one of the largest Latin American education leaks seen. It exposes personal data of students, teachers and staff in São Paulo state, usable for phishing, identity fraud and credential stuffing. The thread now appears closed/removed, so it may be a repost of an older dump — verify freshness before alerting.LeakPriority 55
Presunta filtración de datos de contratistas militares y de gobiernoA DarkForums post claims a 'fresh breach' full data dump of 100M+ records attributed to Raptor Supplies, described as covering military, government and civilian contractors. The claim is unspecific and resembles aggregator-style marketing, so scale and authenticity are unconfirmed. If genuine, contractor credentials and procurement data could expose supplier accounts used by defence and public-sector buyers.LeakPriority 88
Filtración de 3 TB de datos de la energética brasileña Bel EnergyActor SUB-ZER0 posted on DarkNetArmy a claimed full dump (over 3TB, ~12M client records) from Bel Energy/Belenus, a Brazilian solar energy distributor. The dataset is advertised as financial and energy-sector client data, which points to CRM, billing and customer records. For defenders this is a critical-infrastructure-adjacent leak in Brazil requiring LGPD notification and credential/fraud monitoring.LeakPriority 40
Presunta filtración de datos de 100.000 usuarios de un banco de Estados UnidosA LeakForum post offers a file described as full user information for 100,000 customers of an unnamed US bank, labelled as fresh. The vendor does not name the institution and provides no sample evidence, so authenticity and scale cannot be verified from the thread. Defenders at US financial institutions should still watch for credential reuse and identity-fraud activity consistent with such a dataset.LeakPriority 62
Volcados de bases de datos SQL de Colombia publicados en DarkForumsA DarkForums thread advertises SQL database dumps tied to Colombian websites, distributed through the sharedproxy.co handle, and has since been closed by moderators as removed content. SQL-level dumps from regional services typically contain user tables, password hashes or plaintext credentials and internal identifiers that enable follow-on intrusion. Colombian organisations should determine whether their own systems are represented in this collection.LeakPriority 80
Base de datos de Laboral.com.ar de Argentina a la venta con 6,8 millones de registrosAn actor on DarkForums is advertising a dump allegedly extracted from LABORAL.COM.AR, an Argentine employment portal, claiming 6.8 million recent records from 2026. Data of this kind typically includes names, emails, phone numbers and credential material for jobseekers, which directly enables phishing and credential stuffing against individuals and corporate clients. The thread is now flagged as removed content, meaning the file may be circulating privately rather than in the open forum.