BRIEFLeaklowP28
32M Wanelo customer database (2018) offered
Wanelo.com
Detected22 October 2026 · 13:37 UTC
A database of 32 million Wanelo customer records, dated 2018, is being offered on a forum. Although the volume is large, the data is old and its current operational value is limited. It is useful mainly as a historical reference of exposed customer credentials.
CategoryLeak
Severitylow
Priority score28
Detected22 October 2026 · 13:37 UTC
Leak● 48
Venta de 1 millón de datos de usuarios de GeminiA seller is offering one million 'fresh, untouched' Gemini crypto-exchange leads for sale, potentially exposing KYC or marketing data of US users. If genuine, this is a large customer dataset that fuels phishing and account takeover. Worth tracking for downstream fraud and credential abuse.Leak● 65
Publican base de datos de un ataque en GuatemalaA fresh post on a leak forum offers a 'Guatemala Attack DB', suggesting a database stolen in an intrusion against a Guatemalan organization. The target is not yet identified, so scope and sector (public or private) remain unclear, but regional victims warrant immediate monitoring. Defenders in Guatemala should watch for the sample and attribution.Leak● 85
Base de datos de EsSalud Perú a la venta en foro de filtracionesA dark-web actor claims to hold a database for EsSalud, Peru's national public-health insurance agency, and posted it minutes ago. Health-insurer records typically include national ID, medical, and employment data for millions, making this a high-value leak with strong fraud and state-impact potential. Verify the sample quickly and stand up incident response.Leak● 42
Filtración de datos de México y Perú anunciada en foroA recent thread announces a leak labeled Mexico-Peru, though scale and impacted organizations are not yet detailed. If confirmed, it affects LATAM entities and exposes credentials or records usable for account takeover. Requires urgent verification and monitoring of leaked accounts.Leak● 60
Filtración de la base de datos de FFMADRID (ffmadrid.es)A threat actor posted a database dump attributed to FFMADRID (ffmadrid.es), a Spanish sports entity, dated 22 October 2026. Though record volume is unconfirmed, a leak of a real organization exposes member/personal data and login credentials reusable in phishing and credential-stuffing. Defenders should verify scope, force credential resets and monitor resale of the dump.Leak● 58
Filtración de 1,8 millones de credenciales de Privalia BrasilA seller posted a 1.8 million-row URL:login:password dataset attributed to Brazilian fashion retailer Privalia. The volume of valid credentials enables credential stuffing and account takeover against customers across Brazil and Latin America. Defenders should force password resets and monitor for reused passwords tied to the brand.