BRIEFLeaklowP40
253,000-line Brazil mail credential combolist leak
Detected22 September 2026 · 12:01 UTC
A 253,000-line Mail:Pass combolist targeting Brazilian email accounts was posted in 2026 as a fresh 'unique combo'. Dumps of this size expose a large victim pool to account takeover and are frequently reused in region-focused phishing and fraud. Brazilian users, ISPs and banks should treat it as an active credential-reuse risk.
CategoryLeak
Severitylow
Priority score40
Detected22 September 2026 · 12:01 UTC
LeakPriority 42
Base de datos de PII de clientes mexicanos de Cosmotienda filtradaAn actor published a free leak of a Mexican PII database attributed to Cosmotienda, shared on the BlackBones carding forum and labeled as a 2026 dataset. The dump appears to contain customer personal data, exposing affected individuals to identity fraud and targeted phishing. The thread is roughly two months old, so it is not a fresh alert but remains relevant for leak-monitoring of a Latin American retail brand.LeakPriority 40
Filtración de base de datos del Partido Baaz de Irak y SiriaA database attributed to the Iraq/Syria Socialist Ba'ath Party was offered for download on BreachForums, potentially exposing membership or personnel records of a politically sensitive organization. The post provides no clear date or record count, so its recency and scale cannot be confirmed. It is mainly relevant for regional political-risk and counter-intelligence monitoring rather than for AR-LATAM defenders.LeakPriority 48
Publican 18.000 cuentas de Coinbase filtradasA set of roughly 18,000 Coinbase accounts was published on DarkForums by user Zannokar on November 1, 2026 in the cracked-accounts section. Crypto exchange accounts are prime targets for account takeover and direct theft, and leaked credentials fuel credential-stuffing and phishing against users. The moderate size limits impact but the financial sector should watch for credential reuse.LeakPriority 74
Filtración de 7,4 millones de registros de Apteka.ruA 7.4 million record database belonging to Apteka.ru, a major Russian online pharmacy, was posted for download on DarkForums by user UNC6783 on November 7, 2026. Pharmacy databases typically hold customer names, contact details, addresses and order/health-related data, creating a high-value privacy and fraud exposure. Defenders should treat this as a fresh, large-scale leak relevant to credential-stuffing and phishing campaigns.LeakPriority 45
Filtración de base de datos del gobierno de Irak (rss.gov.iq, 100 GB)A xReactor.org thread references a 100GB leak of the rss.gov.iq government database dated August 2026. If genuine, it represents a substantial exfiltration of Iraqi public-sector records with potential PII and account data. It is dated a few months back and concerns a non-LATAM target, so it is relevant mainly as background rather than a fresh alert for AR-LATAM defenders.LeakPriority 88
Base de datos completa del Gobierno de Paraguay a la ventaA BreachForums (bf.st) thread advertises a 'FULL DATABASE GOVERNMENT PARAGUAY,' implying a large-scale exfiltration of Paraguayan public-sector records. If authentic, it could expose citizen PII, internal accounts and administrative data across state entities. This is a high-value LATAM government leak that defenders must verify immediately and track for downstream fraud.