BRIEFLeakhighP78
LexisNexis breach exposes US government agencies and law firm data
LexisNexis
Detected13 October 2026 · 21:53 UTC
A threat actor claims a fresh breach of LexisNexis, exposing legal-intelligence data tied to US government agencies and law firms. This is high-value material that enables targeted social engineering, doxxing and credential abuse against legal and public-sector targets. Organizations relying on LexisNexis should watch for downstream phishing and verify account integrity.
CategoryLeak
Severityhigh
Priority score78
Detected13 October 2026 · 21:53 UTC
Leak● 57
Base de datos de la plataforma de reservas rolzo.com filtradaA fresh database belonging to rolzo.com, described as a premium booking platform, was posted on DarkForums by seller 'hundov' minutes ago. It likely contains customer accounts, emails and booking/PII data of the platform's users. If any of those credentials are reused, they expand the attack surface for account takeover and downstream fraud.Leak● 44
Filtración del código fuente privado de McDonald'sA threat actor is sharing what they claim is McDonald's private source code on a leak forum. Proprietary code can reveal internal logic, vulnerabilities and potentially embedded secrets or credentials, aiding follow-on attacks. The company should assess whether any keys or credentials were exposed.Leak● 45
Base de datos de lindyproperty.com (EE. UU.) a la ventaA seller on Spear Forums is offering a 92,000-record database of the US real estate firm lindyproperty.com. Although the victim is outside Latin America, it is a real organization's customer/lead data going to market, useful for tracking broker activity and cross-referenced B2B phishing. Lower priority for AR-LATAM defenders but worth noting for regional brokers using the same data pipelines.Leak● 52
Filtración de la base de datos de Salesfloor.netA full database dump of Salesfloor.net, a US retail workforce platform, has been published on a leak forum. This exposes customer and employee data of a real company, enabling phishing and credential abuse against its users. Defenders should monitor for reuse of leaked identities in account-takeover attempts.Leak● 72
Filtración de base de datos de colaborador de Iberdrola (zirconite.es)A 153,000-row database of zirconite.es, advertised as an official collaborator of Iberdrola — Spain's largest energy utility — is being shared on Spear Forums. The set exposes usernames, emails and likely client/contract records of a supplier to critical energy infrastructure. Treat this as supply-chain risk that could feed phishing or credential attacks against the Iberdrola ecosystem.Leak● 45
Combolist de 1 millón de credenciales mexicanasA recently posted combolist contains about one million email:password pairs reportedly tied to Mexico. While generic combolists are common, a dataset of this size focused on one country still fuels credential stuffing and account takeover against Mexican users and organizations. Defenders should enforce credential hygiene and block reused passwords.