BRIEFLeakhighP72
Database of 1 million+ IKEA users' personal data for sale
IKEA
Detected17 September 2026 · 06:12 UTC
A threat actor is offering personal information of more than one million IKEA users, a large customer database exposed in a fresh post. The scale and recency make it valuable for credential stuffing, phishing and retail fraud against consumers. Defenders should monitor for downstream abuse while IKEA confirms scope and notifies affected users.
CategoryLeak
Severityhigh
Priority score72
Detected17 September 2026 · 06:12 UTC
Leak● 40
Brecha de datos en un revendedor de hardware de LedgerA thread titled 'LEDGER HARDWARE CRYPTO RESELLER BREACH' was posted on an underground forum, indicating leaked customer data from a reseller of Ledger hardware wallets. Such data typically includes names, addresses and order history, which historically fuels physical-threat and phishing campaigns against crypto holders. The content is login-walled and undated, so scale and recency cannot be confirmed, but the topic is relevant for crypto-asset defenders.Leak● 45
Filtración de base de datos de SquareTrade con 911.000 cuentasA RaidForums clone is offering a free download of a SquareTrade.com database containing roughly 911,000 user accounts and 41.4 million records. The dataset exposes customer contact and account details of a large US device-protection/insurance provider. Because the post has no recent date and this breach has circulated for years, it is a repost rather than a fresh incident, but it can still fuel credential-stuffing and phishing.Leak● 40
Filtración de 228 cuentas corporativas de Telkom IndonesiaA DarkForums leak thread claims 228 records tied to telkom.co.id, described as corporate accounts plus internal access data and tagged 2026. The volume is small, but the target is a national telecommunications operator, so any internal credentials can serve as an initial foothold into critical infrastructure. Defenders should treat it as a possible credential-exposure lead rather than a mass breach.Leak● 54
Filtración de 1,9 millones de registros de la farmacia VITAA database attributed to the VITA Pharmacy (Apteka VITA) website, containing roughly 1.9 million entries, is being shared on DarkForums. The records include identifiers, full names, email addresses, phone numbers and dates of birth, which is enough for identity theft, account takeover and targeted fraud against patients. Health-sector customer data of this size is a high-value asset for credential-stuffing and social engineering campaigns.Leak● 86
Filtración de base de datos de la Universidad Nacional de San LuisA DarkForums user using the handle 'cutzinger' published a thread in the Leaks/Databases section on Sunday 1 November 2026 offering what is claimed to be a database of the Universidad Nacional de San Luis in Argentina. University dumps typically contain student, faculty and administrative records such as DNI, names, institutional emails and phone numbers. This directly exposes an Argentine public academic institution and enables targeted phishing plus credential reuse against linked .edu.ar and government systems.Leak● 62
Filtración de datos del prestamista hipotecario New American FundingOn 31 October 2026 the actor Jarkilon published a 'New American Funding leak' database thread on DarkForums, naming the large US mortgage lender. The listing implies borrower and applicant PII — names, contacts and loan/financial data — was exfiltrated, a high-value asset for phishing and identity fraud. US financial-sector defenders and the lender's customers should treat the data as exposed.