BRIEFLeakhighP62
ETFdb.com/VettaFi database with 60M records offered for sale
ETFdb.com / VettaFi
Detected30 October 2026 · 03:24 UTC
A seller on PwsForums is advertising a database attributed to ETFdb.com/VettaFi claiming 60 million records covering roughly 270,000 users, sold in the marketplace section. VettaFi is a US financial-data and indexing provider whose platforms serve asset managers and advisors, so the data may include professional contact details, subscription data and hashed credentials of financial-sector users. Large financial-data leaks are valuable for BEC, credential stuffing against investment platforms and follow-on social engineering of advisors.
CategoryLeak
Severityhigh
Priority score62
Detected30 October 2026 · 03:24 UTC
Leak● 54
Base de datos de 555.000 propietarios franceses a la ventaA PwsForums seller (Dedale) is offering a 555,000-record dataset described as French homeowner data, with the thread bumped within the last hours. The volume and the property-owner framing point to PII such as names, addresses and contact details rather than credentials, likely aggregated from real-estate or public records sources. Such lists enable high-quality phishing, impersonation and physical-risk targeting of French residents, and should be tracked even though no specific organisation is named.Leak● 48
Base de datos del DHS de EE.UU. ofrecida para descargaA thread on the Spear forum markets a downloadable database attributed to the US Department of Homeland Security; the body is login-restricted, so scale and authenticity remain unverified. Claims of this kind are often recycled or fabricated, but a genuine DHS-linked dataset would affect federal security operations and contractor data. It should be tracked as an unverified high-value leak claim pending validation.Leak● 52
Leak de 12,9 millones de credenciales URL:LOG:PASS en DarkForumsA user named Kovnonos published a 12.9 million-line URL:LOG:PASS corpus on DarkForums on 19 October 2026, described as private and high quality. The format indicates stealer-log style data pairing login URLs with plaintext credentials, which fuels credential stuffing and initial access against web portals. Because it is a mixed multi-site dataset, any organization with public login portals should check for its own domains inside the leak.
Leak● 91
Filtración de datos de 10.632 empleados públicos de Santiago del EsteroA DarkForums user is distributing a database of 10,632 records labelled as Argentina's GDE (Gestión Documental Electrónica) users, i.e. government employees of Santiago del Estero province. GDE is the national document-management platform used across Argentine public administration, so the dump likely exposes full names, DNI, work emails and possibly account identifiers usable for credential-stuffing or targeted phishing. Any compromise of public-sector identity data in Argentina is a direct precursor to fraud and lateral access into provincial systems.Leak● 50
Base de datos de 1 millón de registros de la telemedicina MedixbdA darkweb forum posting advertises a database belonging to Medixbd, a telemedicine platform, with a stated volume of one million records. If genuine, the dump would cover patient identities, contact data and likely appointment or clinical metadata, which is sensitive personal and health information. The post body sits behind a login wall, so the seller's sample and pricing are unverified and the publication date is unknown.Leak● 56
Filtración de datos de Crunchbase publicada en DarkForumsA user (Ulznidar) posted on DarkForums a downloadable leak claimed to come from Crunchbase, the business-intelligence and company-data platform. The exact record count is not shown in the thread preview, but Crunchbase holds corporate contact, funding and employee data used widely for B2B targeting. If authentic, defenders should expect follow-on phishing and account-takeover attempts against listed executives and startups.