BRIEFLeakhighP44
RFFM ES database posted on ransomware forum
RFFM (España)
Detected25 October 2026 · 08:50 UTC
A thread titled 'DATABASE RANSOM RFFM ES' on an onion ransom/leak forum claims a dumped database from a Spanish entity, likely a regional football federation, behind a login wall. If confirmed, it would expose member, licensing and affiliate data of a Spanish sports organization, useful for phishing its clubs and staff. Scope and date are unverified; confirm the victim, record count and whether extortion is ongoing before escalating.
CategoryLeak
Severityhigh
Priority score44
Detected25 October 2026 · 08:50 UTC
Leak● 24
Filtración de 1,6 GB de logs de stealer recientes (20-10-2026)A 1.6 GB batch of infostealer logs dated 2026-10-20 is being shared on Blackhat Pakistan. The material is recent and could contain corporate session cookies, saved passwords and browser data from many users, but no specific victim organization is identified. Value depends on internal matching against monitored credentials and domains; on its own it is generic and not an AR-LATAM critical-infrastructure event.Leak● 30
Filtración de 54,7 millones de credenciales URL:LOG:PASSA 54.7M-line URL:LOG:PASS credential set has been posted as a private 'UHQ' dump, far larger than typical combolists and likely spanning many unrelated services. While it is not tied to a single named organization, its scale makes it a credential-stuffing and account-takeover risk worth cross-referencing against monitored domains. Origin and freshness are unconfirmed, so treat as background intel rather than a fresh alert.Leak● 66
Filtración de datos del Instituto de Seguridad Social de PaulistaA database belonging to the municipal social security institute of Paulista (Pernambuco, Brazil) has been posted for public download on BreachForums. Such entities hold beneficiary, payroll and identity records of municipal public servants, which are directly usable for fraud, social engineering against staff and lateral targeting of local government systems. Defenders in Brazilian municipal administration should verify the exposure, scope of records and reset any credentials present.Leak● 38
Base de datos de Blizzard Computer Store (Kuwait) en ventaA seller is offering a database belonging to Kuwait-based Blizzard Computer Store, posted roughly 11 hours ago. The scale is unclear but likely a small retail customer dataset rather than critical infrastructure. Low regional relevance, useful only as general leak-trend monitoring.Leak● 47
Filtración de base de datos de 50 millones de registros de IndonesiaA 50-million-record Indonesian database linked to 'JakartaGhostDigital' is circulating, exposing massive volumes of personal and account data. Leaks this large fuel credential stuffing and fraud that can reach regional services. Check the set for AR-LATAM corporate or government credentials before deprioritizing.Leak● 55
Código fuente y base de 1,1M de usuarios de MediaModifier a la ventaA seller is offering the complete production SaaS codebase of MediaModifier.com plus a database of about 1.1M users across 13 services. Full source plus user data exposes secrets, API keys and authentication logic, enabling account takeover and further compromise of the vendor and its customers. Defenders should flag leaked credentials and embedded secrets for rotation.