BRIEFGov / MilitarycriticalP88
São Paulo Civil Police database offered for sale
Polícia Civil de São Paulo
Detected8 November 2026 · 00:43 UTC
A threat actor is selling a database allegedly belonging to the São Paulo Civil Police (Polícia Civil de São Paulo), a Brazilian state law-enforcement agency, on BreachForums' leak marketplace. Police records typically include officer and citizen PII, case data and identifiers that enable targeted fraud, doxxing and attacks on law-enforcement personnel. This is a high-value government target in Latin America and warrants urgent validation and containment.
CategoryGov / Military
Severitycritical
Priority score88
Detected8 November 2026 · 00:43 UTC
Gov / MilitaryPriority 90
Filtración de base de datos del SAT de Ica, Perú (satica.gob.pe)A DarkForums leak advertises a database from satica.gob.pe, the Peruvian municipal tax administration service (SAT) of Ica, containing DNI national IDs, RUC tax numbers, contracts and invoices. This is direct exposure of citizen and government records tied to a real .gob.pe domain. Such data enables identity fraud and targeted attacks against the tax authority and local businesses.Gov / MilitaryPriority 90
Base de datos fiscal completa del SAT de Ica (Perú) a la ventaA threat actor on DarkForums is selling the full tax database of Peru's SAT Ica (satica.gob.pe), including DNI, RUC, contracts and invoices. Leaked national ID and taxpayer records enable identity theft, tax fraud and targeted phishing. It is a direct hit on a Peruvian government tax authority.Gov / MilitaryPriority 88
Filtración de 40.000 registros de la Comisión Nacional de ValoresAn actor on DarkForums is offering 40,000 records allegedly from Argentina's National Securities Commission (CNV), the country's financial market regulator. The leak reportedly includes internal documents exposing staff and operational details. Compromise of a financial oversight body enables targeted phishing against brokers and other state financial entities.Gov / MilitaryPriority 62
Filtración de datos de 30 oficiales de la Unidad 8200 de IsraelOn 7 November 2026 a DarkForums user (MrDarkRoot) posted a database allegedly containing personal data of 30 officers of Israel's Unit 8200 signals-intelligence corps. Volume is small but the targeting is deliberate: exposing military intelligence personnel enables doxxing, harassment, social engineering and insider recruitment. Any defence or intelligence organisation should treat this as a personnel-exposure incident, not routine forum noise.Gov / MilitaryPriority 72
Publican base de datos hackeada del Instituto de Control VehicularA second DarkForums thread by 'Ph4ntom0x_1711' advertises the same hacked database from the Instituto de Control Vehicular, the Mexican state registry of vehicles and drivers, published in November 2026. The dataset would expose owner names, addresses, plates and engine numbers used for cloning and fraud. Duplicate publication increases pressure to contain the data and notify affected owners.Gov / MilitaryPriority 80
Base de datos del Instituto de Control Vehicular de México hackeadaActor 'Ph4ntom0x_1711' published on DarkForums a database claimed to come from the Instituto de Control Vehicular, the Mexican state agency that holds vehicle registration and driver records. Such registries contain names, addresses, plates and VINs, which fuel vehicle cloning, fraud and targeting of owners. Exposure of a government transit registry is a high-impact privacy and public-safety issue.