BRIEFLeaklowP33
Telefonica.net email combolist leaked on underground forum
Telefonica.net
Detected18 September 2026 · 08:12 UTC
A credential combolist of Telefonica.net email accounts was posted to a cracking forum as mail:pass pairs. Although stale (August 2025) and credential-stuffing style, Telefonica is critical telecom infrastructure across Spain and Latin America. Defenders should check for password reuse against corporate accounts and enforce MFA.
CategoryLeak
Severitylow
Priority score33
Detected18 September 2026 · 08:12 UTC
Leak● 40
Base de datos de Xiaomi China publicada en foro de hackingForum user 'Myra' published a claimed Xiaomi China database as CSV files (service or customer records) on SpyHackerz; the exact posting date is not stated. If genuine, the data would support smishing and account takeover against Xiaomi customers in China and partners in the supply chain. Treat the claim cautiously until a sample is validated, but flag Xiaomi-linked credentials for monitoring.Leak● 70
Base de datos de Binance con 335 millones de registros a la ventaSeller 'Felixben' advertised a Binance database dated 2026 claiming 335 million records, listed on DarkForums' Leaks Market on 2 November 2026. The volume, if genuine, would cover a large share of the exchange's global user base and exposes identity and contact data usable for phishing, SIM-swap and account takeover. Exchange customers and Binance's fraud teams should assume the data may be used for credential stuffing.Leak● 88
Filtración de la base de datos de la Universidad de Buenos AiresUser 'skyling' posted a database allegedly belonging to the University of Buenos Aires (UBA) on BreachForums on 2 November 2026. UBA is Argentina's largest public university, with student, staff and alumni records that feed directly into public-sector and research networks, so any dumped credentials carry real lateral-movement risk. The dump is fresh and should be treated as an active exposure until scope is confirmed.Leak● 42
Base de datos del registro civil Dukcapil Madiun (Indonesia) publicadaA RaidForums thread publishes a download of the Dukcapil civil-registry database for Madiun regency, Indonesia, which normally holds national ID numbers, family records and addresses. Government identity registries are the highest-value source for synthetic identity fraud and KYC bypass, but the thread appears to be an older repost rather than a new breach. It is worth cataloguing for regional identity-fraud trends rather than alerting as a fresh incident.Leak● 50
Presunta filtración de 11 millones de registros de la francesa ChronopostA DarkForums post advertises an 11-million-record dataset attributed to Chronopost, the French parcel arm of La Poste; the body is login-walled so only the headline claim is visible. Shipping data of that size typically includes names, addresses, phone numbers and tracking numbers, the exact raw material for parcel-phishing campaigns. French logistics and e-commerce customers could see convincing fake delivery notices within days if the data is real.Leak● 55
Afirman filtración de base de datos de Bank of AmericaA DarkForums thread advertises a leaked Bank of America database, though the body is behind a login wall and only the title is visible, so the volume and authenticity are unconfirmed. Claims against a top-tier bank are often recycled or fabricated, but if real they would enable large-scale phishing and account-takeover attempts against customers. Monitoring for re-posted samples and credential reuse is warranted until the claim is disproven.