BRIEFLeakhighP80
Database of millions of Mexican citizens offered for sale
Base de datos de ciudadanos mexicanos (origen no identificado)
Detected1 November 2026 · 16:24 UTC
A DarkForums seller (Lyklekor) is offering a multi-million-record database of Mexican citizens, likely aggregated from electoral, civil registry or public-sector sources. Mexican citizen data fuels identity theft, credit fraud and targeting of public servants, and such dumps are usually split and resold in parts to evade detection. Fields such as CURP, RFC and address determine how exploitable the data is for downstream fraud.
CategoryLeak
Severityhigh
Priority score80
Detected1 November 2026 · 16:24 UTC
Leak● 45
Base de datos de 1,7 millones de usuarios de Nexo en circulaciónA xReactor thread advertises a 1.7-million-record customer database attributed to the crypto lending platform Nexo, including KYC-style identity data for a financially sensitive user base. The thread appears old (deep pagination, no fresh date), so it is not a new breach but still relevant for credential-stuffing and crypto-targeted phishing. Victims face high-value account takeover and extortion risk because balances and verified identities are involved.Leak● 89
Filtración de 1,1 GB de la Corte Superior de Justicia de Lima NorteA DarkForums actor (Lynfekor) published a 1.1 GB archive attributed to the Superior Court of Justice of Lima Norte, one of Peru's highest-volume judicial districts. Judicial archives typically contain case files, litigants' DNI and contact data, internal correspondence and staff accounts, exposing citizens, judges and clerks to extortion and targeting. Leaked judicial material can also reveal investigative details and protected witnesses.Leak● 94
Base de datos del RENIEC de Perú (31 millones) a la ventaA DarkForums actor (Jartezon) is advertising a 31-million-record extract of Peru's RENIEC national identity registry, the source of DNI numbers, full names, birth dates and addresses for essentially the entire adult population. A complete civil registry is the master key for mass identity fraud, SIM-swap, account takeover at banks and telecoms, and impersonation of public officials. Any Peruvian verification process that trusts DNI data alone must be considered compromised.Leak● 45
Base de datos del seguro social chino (474.000 filas) a la ventaA BreachForums seller is offering a 474,000-row database attributed to a Chinese government social security bureau, likely containing citizen identity and social-insurance records. Such data supports identity fraud and large-scale targeting of government beneficiaries, and the sample should be validated before resale spreads it further. Impact for Latin American defenders is limited, so it warrants tracking rather than immediate regional action.Leak● 50
Filtración de datos de Main Line Health con SSN y correos de pacientesA BreachForums thread advertises a database attributed to mainlinehealth.org containing roughly 17,700 rows, including more than 8,000 Social Security numbers and 468 email addresses. If genuine, the SSN concentration points to patient or employee identity data from a US hospital network, enabling identity theft, medical fraud and targeted social engineering. Healthcare defenders should verify the sample and prepare notification and SSN-monitoring steps.Leak● 45
Base de datos de forex de 400.000 registros de Dinamarca y Países Bajos a la ventaA seller is offering a 400,000-record forex database covering Denmark and the Netherlands on BreachForums. The dataset appears to be customer and investor lead data from forex trading platforms, valuable for fraud, phishing and targeted scams. Financial firms and regulators in those markets should treat the records as compromised.