BRIEFLeakhighP67
200M+ Telegram users database with usernames and phones for sale
Telegram (usuarios globales)
Detected17 September 2026 · 05:12 UTC
Reposts collapsed2
A database with over 200 million Telegram records mapping usernames to phone numbers is circulating in a leak forum. Such a dataset enables mass doxxing, SIM-swap, phishing and linking of pseudonymous accounts to real identities. It is valuable to defenders tracking Telegram-linked threat actors and to fraud and anti-abuse teams worldwide, including in Latin America.
CategoryLeak
Severityhigh
Priority score67
Detected17 September 2026 · 05:12 UTC
Leak● 62
Filtración de datos del prestamista hipotecario New American FundingOn 31 October 2026 the actor Jarkilon published a 'New American Funding leak' database thread on DarkForums, naming the large US mortgage lender. The listing implies borrower and applicant PII — names, contacts and loan/financial data — was exfiltrated, a high-value asset for phishing and identity fraud. US financial-sector defenders and the lender's customers should treat the data as exposed.Leak● 65
Ministerio del Interior de Taiwán: base de 23,57M de ciudadanosBreachForums sellers listed a 'full citizens' extract of Taiwan's Ministry of the Interior register, claiming 23.57 million records at 100% coverage (now marked sold out). If genuine, it exposes national ID, address and household data for essentially the entire adult population, enabling identity fraud and social engineering. Taiwanese government bodies and any service relying on citizen-ID verification should treat this data as compromised.Leak● 56
Base de datos de la promotora malasia Mah Sing Group a la ventaThe actor scarlettgroup posted a database belonging to Mah Sing Group Berhad (mahsing.com.my), a major Malaysian property developer, on DarkForums on Sunday 1 November 2026. Dumps of this type typically contain customer, sales and employee records useful for targeted phishing and fraud. Malaysian real-estate firms and the company's customers should verify the leak and monitor for misuse.Leak● 62
Base de datos del diario uruguayo la diaria a la ventaA cybercriminal thread on an onion forum advertises a database belonging to la diaria, a Uruguayan independent newspaper (ladiaria.com.uy). The thread is login-walled so the record count and price are unknown, but a media outlet in the region is a plausible target for subscriber and staff credential exposure. Leaked newsroom or subscriber data enables phishing against journalists and can be reused for account takeover.Leak● 30
Publicada una brecha de sitios .gov.ma (Marruecos)The actor 'fexus' posted a thread on BreachForums titled '.gov.ma websites breach', indicating data from Moroccan government sites. However, the post is dated mid-May 2026, roughly six months before today, so it is not a fresh alert and the specifics of the leak are not detailed in the captured text. It is a government-sector exposure but outside the Argentina/LatAm focus and already stale.Leak● 45
Filtración de 200.000 credenciales corporativas de Alemania (D4RKNETHUB)The D4RKNETHUB actor is distributing 'Part (6)' of a dataset containing roughly 200,000 German corporate email:password records, reposted across several forums including DarkNetArmy, Niflheim and HARD-TM. These mail:pass combos are directly usable for credential stuffing, account takeover and business email compromise against German companies. Fresh corporate credential sets like this are actively exploited for phishing and unauthorized access.