BRIEFLeakhighP72
275-million-record Instructure (Canvas LMS) database for sale
Instructure Holdings (Canvas LMS)
Detected24 October 2026 · 02:14 UTC
A seller on PwsForums is offering a 275-million-record database attributed to Instructure Holdings, the company behind Canvas LMS used by universities and schools worldwide. The scale points to a major breach affecting student and educator accounts. Leaked education-platform data fuels credential stuffing, phishing and downstream intrusions at institutions.
CategoryLeak
Severityhigh
Priority score72
Detected24 October 2026 · 02:14 UTC
Leak● 76
Filtración de datos del contratista de defensa Rheinmetall DefenceA leak attributed to European defense contractor Rheinmetall Defence was posted on a criminal forum, with an unknown volume of internal data on offer. Defense contractors are prime targets for espionage and follow-on intrusion, and any exposed credentials, project documents or supplier details raise the risk of supply-chain compromise. Defenders in the defense industrial base should treat this as a potential precursor to credential-based attacks and monitor related infrastructure.Leak● 40
Filtración de base de datos de learncrypto.com con 43.947 registrosA 43,947-record database for learncrypto.com is posted on a dark-web forum for download. Though small in scale, crypto-education platforms hold user credentials and wallet-related data attractive for phishing. Credential reuse makes this relevant for account-takeover monitoring.Leak● 44
Filtración parcial de la base de datos de usuarios de StripchatA partial database from adult streaming platform Stripchat is being distributed for download on a dark-web forum. Even partial dumps expose user emails, hashed passwords and activity data, enabling credential stuffing and sextortion. Users and defenders should treat reused passwords as compromised.Leak● 65
Filtración de base de datos de la financiera Ameriprise FinancialA database attributed to Ameriprise Financial, a major US wealth-management and insurance firm, is being shared on a dark-web forum for download. Exposure of client and account data at a financial institution raises direct fraud and account-takeover risk. Defenders should watch for credential reuse and targeted phishing against customers.Leak● 40
Filtración de base de datos de la tienda surcoreana metree.co.krA seller on DarkForums posted a sample of a database allegedly taken from metree.co.kr, a South Korean e-commerce site, with 2026 data. Samples are published to prove authenticity before the full sale, exposing customer PII such as emails, addresses and order history. Outside Latin America, but useful for supply-chain and partner-exposure checks involving Korean vendors.Leak● 86
Base de datos del banco boliviano BancoSol a la ventaA seller on RaidForums posted on 23 October 2026 offering what is described as the customer database of BancoSol, one of Bolivia's largest banks. Banking KYC records fuel credential stuffing, vishing and account takeover against Bolivian retail and corporate clients. Identifiers from this leak should be treated as compromised and monitored for follow-on fraud across the region.