BRIEFLeaklowP40
Combolist targeting telecom domain telefonica.net (Telefonica)
Telefonica
Detected22 September 2026 · 13:01 UTC
A forum user published a ~5,919-line credential list sorted and targeted at the telefonica.net domain (Telefonica). Although small, it is a named telecom target with extensive Latin America and Spain operations, making it useful for credential stuffing against corporate mail and VPN portals. Defenders should force credential rotation and MFA on affected accounts and watch for reused passwords.
CategoryLeak
Severitylow
Priority score40
Detected22 September 2026 · 13:01 UTC
LeakPriority 50
Alegado volcado de la base de datos de usuarios de IKEAA DarkForums user (XOUCAO, November 2026) posted a thread claiming to hold IKEA's user database with all customer personal information. The post shown includes no sample, record count or proof of access, so the claim is unverified and could be recycled or fabricated data. Retail customer databases of this size are valued for credential stuffing and targeted phishing campaigns.LeakPriority 60
Filtración de la base de datos interna de la Universidad Uniguaçu (Brasil)An actor on the Spear/Spear4h underground forum published an 'internal database dumped' entry attributed to Universidade Uniguaçu, a private Brazilian university; the thread is login-walled, so record counts and data types are not visible. University internal databases normally hold student, staff and financial records that fuel phishing and fraud. Brazilian education institutions are frequently targeted, so the claim should be verified directly with the institution.LeakPriority 56
Base de 17 millones de perfiles de Instagram de EE. UU. obtenida por API a la ventaA seller on DarkForums is offering a 17 million record dataset of US instagram.com accounts obtained through API scraping, dated 2026. While it likely contains profile and contact metadata rather than credentials, at this scale it fuels targeted phishing, SIM-swap pretexting and account-takeover attempts against high-profile users. Defenders should treat exposed emails and phone numbers as compromised identifiers.LeakPriority 66
Filtración de 120,7 millones de registros del sector educativo de São PauloA dataset labelled 'Brazil SP EDUCATION' with 120.7 million records was published on DarkForums, one of the largest Latin American education leaks seen. It exposes personal data of students, teachers and staff in São Paulo state, usable for phishing, identity fraud and credential stuffing. The thread now appears closed/removed, so it may be a repost of an older dump — verify freshness before alerting.LeakPriority 55
Presunta filtración de datos de contratistas militares y de gobiernoA DarkForums post claims a 'fresh breach' full data dump of 100M+ records attributed to Raptor Supplies, described as covering military, government and civilian contractors. The claim is unspecific and resembles aggregator-style marketing, so scale and authenticity are unconfirmed. If genuine, contractor credentials and procurement data could expose supplier accounts used by defence and public-sector buyers.LeakPriority 88
Filtración de 3 TB de datos de la energética brasileña Bel EnergyActor SUB-ZER0 posted on DarkNetArmy a claimed full dump (over 3TB, ~12M client records) from Bel Energy/Belenus, a Brazilian solar energy distributor. The dataset is advertised as financial and energy-sector client data, which points to CRM, billing and customer records. For defenders this is a critical-infrastructure-adjacent leak in Brazil requiring LGPD notification and credential/fraud monitoring.