BRIEFLeakhighP58
29.29 million URL:LOG:PASS credential base published
Detected17 September 2026 · 02:12 UTC
A 29.29 million-line URL:LOG:PASS stealer log is being shared privately as a supposedly fresh base. It contains credentials harvested from infected devices, enabling credential-stuffing, account takeover and fraud at scale. Organizations should assume corporate credentials are exposed and enforce MFA and password resets.
CategoryLeak
Severityhigh
Priority score58
Detected17 September 2026 · 02:12 UTC
Leak● 72
Base de datos del club La Reserva Sotogrande a la venta en DarkForumsA threat actor is advertising on DarkForums an 'exclusive 2026' database attributed to the private La Reserva Club Sotogrande in Spain, claiming 31 million+ records of wealthy clients. If genuine, it exposes high-net-worth individuals' contact and membership data, a prime target for fraud, extortion and spear-phishing. The record count is likely inflated, but a named luxury-club leak is still worth verification and notification.Leak● 52
Filtración de 49 GB de la base de datos de Alnair (EAU)A listing on the PwnForums onion site advertises a 49 GB dump of the Alnair (alnair.ae) database from the United Arab Emirates. At that volume the dataset likely contains large customer, transaction or operational records, giving fraudsters material for identity theft and business email compromise. Regional enterprises and the firm's clients should treat the data as compromised until proven otherwise.Leak● 55
Filtración de datos y código fuente de SangomaA DarkForums thread by N1KA offers a download of Sangoma.com data together with source code, spanning multiple pages of replies. Sangoma supplies VoIP gateways and PBX platforms widely used in enterprise and public-sector telephony, so source code disclosure raises supply-chain risk for telecom infrastructure. Organisations running Sangoma/FreePBX gear should assume deeper knowledge of product internals is now available to attackers.Leak● 58
Filtración de datos personales del Congreso de FilipinasDarkForums user Ilknorix posted on 30 October 2026 a PII leak attributed to the Congress of the Philippines, a national legislative body. Leaked personal data of legislators, staff and constituents enables targeted phishing, impersonation and pressure campaigns against public officials. Government entities in the region should treat this as a genuine public-sector exposure and monitor for weaponised data.Leak● 60
Base de datos del PT (Partido de los Trabajadores) de Arujá, BrasilA BreachForums database thread advertises a dump belonging to the Workers' Party (PT) branch in Arujá, São Paulo, Brazil. Political party records typically contain member lists, CPF numbers, addresses and contact details of activists and public figures, exposing them to doxxing and harassment. This is a politically sensitive leak in Latin America and could be reused for influence or intimidation campaigns.Leak● 64
Base de datos con datos personales de cosmotienda (México)DarkForums user Jaded published a thread advertising a Mexican PII database tied to cosmotienda, with a multi-page discussion indicating a downloadable dataset. The content points to personal data of Mexican customers, useful for fraud, phishing and account takeover schemes targeting the region. Mexican consumers and the retailer's partners should assume the data is in circulation until the dump is verified as fake or stale.