BRIEFLeakhighP58
Payback Germany database of 40 million customers for sale
Payback (Alemania)
Detected11 October 2026 · 18:34 UTC
Actor 'Koshyrman' is selling a 40-million-record database belonging to Payback, a major German loyalty and payments program. Such a leak exposes extensive customer PII (names, addresses, emails, phone numbers) and enables mass phishing, credential stuffing and account takeover. It is outside Latin America, but its scale and recency make it a credible large-breach sale worth tracking.
CategoryLeak
Severityhigh
Priority score58
Detected11 October 2026 · 18:34 UTC
Leak● 42
Combolist de 468.000 credenciales de Brasil a la ventaA forum seller is offering a fresh, high-quality set of roughly 468,000 Brazilian credential pairs (email:password). It is not tied to a single named organization, but the volume and Brazilian origin make it usable for credential-stuffing against LATAM accounts and services. Regional defenders should watch for reuse of these exposed credentials.Leak● 58
Filtración de base de datos de la mexicana iPESA PinturesA threat actor is publishing a database allegedly belonging to Mexican paint retailer iPESA Pintures (pintando.com.mx). If genuine, the dump exposes customer and possibly corporate records usable for phishing, fraud and credential stuffing against Mexican users. Mexican organizations and resellers should verify the exposure and warn affected customers.Leak● 42
Filtración de datos del servicio anti-bot DoubleCounter.ggA breach of DoubleCounter.gg, a Discord anti-alt and verification service, was posted on 11 October 2026. The platform stores user IDs, IP addresses and verification metadata for many communities, so the leak can expose linked accounts and infrastructure details. It is niche and non-regional, but fresh and could feed downstream account and fraud attacks.Leak● 44
Base de datos de 2 millones de suscriptores móviles de Indonesia a la ventaA seller is offering a database of 2 million Indonesian mobile subscribers reportedly derived from SIM-card registration records, including identity and phone data. This is a large telecom dataset that enables SIM-swap, fraud and identity theft at national scale. It sits outside the LATAM region, so it is relevant as a sizeable national telecom leak but not a regional alert.Leak● 50
Datos de clientes de Binance Australia a la ventaA RaidForums seller is offering a dump of Binance Australia customer data for sale. Compromised exchange records expose account holders to targeted phishing, credential stuffing and SIM-swap fraud. Security teams at the exchange and its customers should watch for follow-on account-takeover and social-engineering campaigns.Leak● 55
Base de datos de 109.392 usuarios de Coinbase a la ventaA RaidForums seller is offering a database of 109,392 Coinbase accounts with balances attached, indicating compromised credentials of real users. Such records fuel targeted phishing, credential stuffing and account takeover against crypto holders, who face direct financial loss. Defenders should treat it as a credential-leak signal and push MFA and password resets to affected accounts.