BRIEFLeakhighP58
Stolen Ledger database (309,000 records) offered for sale
Ledger
Detected26 September 2026 · 09:16 UTC
A threat actor (Gogi_data) is circulating a claimed 2026 Ledger customer database of about 309,000 records, cross-posted on DarkNetArmy, BlackBones, SpyHackerz and LEET. Ledger sells crypto hardware wallets, so leaked customer PII (names, emails, addresses, phones) directly fuels targeted phishing, SIM-swap and even physical-threat campaigns against high-value crypto holders. Defenders should treat affected users as at elevated risk and watch for credential reuse.
CategoryLeak
Severityhigh
Priority score58
Detected26 September 2026 · 09:16 UTC
LeakPriority 22
Antigua filtración de base de datos de una universidad presbiterianaA DarkForums thread by user 'AnonOne' advertises a database from a Presbyterian university, with the original post dated back to 18 May and no sign of recent activity. The record count and contents are unverified and the thread is clearly stale, so it is not a fresh incident. It still merits a low-priority check because university databases hold staff and student PII useful for phishing.LeakPriority 40
Venta de datos de la naviera ucraniana Alpha Crewing tras un hackeoAn actor on DarkForums is advertising a compromise of alphacrew.com, a Ukrainian marine crewing and shipping company, and offering the stolen data for sale. Crewing firms hold passports, seafarer certificates, medical records and payroll data, which are directly usable for identity fraud and follow-on attacks against shipping operators. Compromise date and record volume are not stated.LeakPriority 45
Base de datos con 40 millones de mujeres indias a la ventaSeller 'lauraallen' posted on the DarkNetArmy unverified marketplace a 40-million-record database described as Indian women, dated 27 October 2026. Files segmented by gender and nationality are usually compiled from marketing, telecom or e-commerce sources and are prime material for phishing, KYC fraud and SIM-swap campaigns. Scale is large even though the source organization is not identified.
LeakPriority 48
Datos de usuarios de Coinbase en Australia a la ventaAn unverified seller on DarkNetArmy offered what is described as Coinbase crypto data tied to Australia. Coinbase is a high-value crypto exchange, and customer account data could fuel account takeover and fraud. The scale and authenticity are unconfirmed, so the claim requires verification.LeakPriority 55
Datos de la financiera inmobiliaria Berkadia a la ventaA seller on the DarkNetArmy unverified marketplace posted a listing for data tied to Berkadia, a large US commercial real-estate finance company. Details and volume are thin, but the target handles loan, borrower and counterparty records, so a real breach would expose financial and personal data. Confirm authenticity before notifying partners or customers.LeakPriority 25
Reaparición de la filtración de la base de datos de RaidForumsThe DarkForums user Amirxx60 posted on 9 November 2026 what is presented as the RaidForums.com database, a large hacking forum whose user records were already compromised years ago. This is likely a re-circulation of old data rather than a new breach, so it carries little fresh risk. It is still useful for checking reuse of known credentials.