BRIEFLeakhighP60
2 million-line database of Spain's helity.es for sale
helity.es
Detected4 November 2026 · 08:24 UTC
Reposts collapsed2
A seller on an onion forum is offering a database attributed to helity.es, a Spanish company, containing roughly two million lines of records. A dump of this size enables credential stuffing, phishing and identity fraud against Spanish users, and any real customer data must be treated as exposed until verified. The listing appeared alongside multiple other country-specific database sales from the same vendor.
CategoryLeak
Severityhigh
Priority score60
Detected4 November 2026 · 08:24 UTC
Leak● 50
Base de datos de Herbiolys (Francia) con IBAN a la ventaA vendor is selling a dump attributed to the French company herbiolys.fr with about 1.3 million lines and roughly 1,500 unique IBAN records. Bank account data sharply raises fraud risk, enabling direct-debit abuse, invoice fraud and highly targeted phishing against customers and partners. French financial and retail defenders should treat the leaked payment identifiers as compromised.Leak● 45
Base de datos de 80.000 clientes de juandediego.es a la ventaA seller on the pwnfrm onion forum offers an 80,000-record database from the Spanish company juandediego.es, including CIF/NIF tax identifiers and IBAN bank details. Business and financial identifiers of this kind support invoice fraud, vishing and business email compromise against Spanish customers and suppliers. The dump should be confirmed and affected clients warned.Leak● 55
Base de datos SQL de 7 GB de la española Etestify a la ventaA seller advertises a 7 GB SQL export of etestify.com with around 84,000 member records, listed under Spain. Such dumps typically contain emails, hashed passwords and profile data usable for credential stuffing and phishing. Spanish organisations relying on the same platform or customer base should assess exposure and prepare notifications.Leak● 62
Base de datos del servicio de bomberos francés SDIS (7K registros) publicada por AplaGroupA threat actor using the handle AplaGroup is advertising a database allegedly belonging to a French fire and rescue service (SDIS), roughly 7,000 records, on the pwnfrm onion forum. Although small in volume, the victim is an emergency-services organization, so exposed data likely includes personnel, contact and operational details useful for spear-phishing or physical targeting. The post date is not visible in the recovered thread, so recency should be confirmed before escalating.Leak● 48
Datos y permisos de base de datos de Shanghai IMPACT Therapeutics a la ventaA BreachForums thread advertises 'Database Permissions and Full-Set Data' belonging to Shanghai IMPACT Therapeutics (HKEX: 07630), a clinical-stage biopharma company. It appears to offer both live database access and a full copy of the dataset, implying a real organizational compromise rather than a combolist. Sensitive research and clinical data could be at risk, though it is outside the AR-LATAM focus and the date/scale are unverified.Leak● 76
Base de datos del Ejército Argentino filtrada por EsqueleSquadThe actor EsqueleSquad published a database allegedly belonging to the Argentine Army (Ejército Argentino) in the leak section of the Spear Leaks forum, presented as a downloadable archive. Although the thread dates from late July 2026 and is therefore a few months old, it exposes military personnel or institutional data and remains a valid exposure for credential stuffing and targeting of defense staff. Any records tied to .mil.ar identities should be treated as already compromised and monitored for reuse.