BRIEFLeaklowP30
32 million-line credential dump tied to StarLinkClouds published
Detected11 November 2026 · 04:43 UTC
A user on NulledBB released a roughly 32.2 million-line URL:login:password corpus under the Secretline.top and StarLinkClouds labels. It is a generic stealer-log aggregation rather than a single-organization breach, but the volume makes credential-stuffing and account-takeover attempts against corporate and consumer services more likely. No named victim is identifiable from the post.
CategoryLeak
Severitylow
Priority score30
Detected11 November 2026 · 04:43 UTC
LeakPriority 58
Base de datos de 1M de usuarios de Gulf Air a la ventaA seller using the handle databreach000 is offering roughly 1 million Gulf Air (gulfair.com) user records on the DarkForums marketplace. Gulf Air is Bahrain's national carrier, so the data likely includes customer identities and contact details that enable credential-stuffing and targeted phishing against travellers and airline loyalty users. Large airline datasets also carry regulatory and fraud-handling implications for the company and its partners.LeakPriority 74
Base de datos del Ministerio de Electricidad de Kuwait publicadaA database belonging to Kuwait's Ministry of Electricity and Water (mew.gov-kw), a national critical-infrastructure body, was posted for distribution on a BreachForums marketplace leak section. The exposure of a government energy ministry directly affects infrastructure operators and could enable follow-on access or targeted phishing against staff. It is outside the AR-LATAM scope but is a genuine government critical-infrastructure data exposure worth tracking.LeakPriority 48
Volcado de base de datos completa 'RF' de 405 GB distribuido como torrentA 405 GB 'RF FullDatabase' archive is being shared as a torrent on Cracked.st under the Other Leaks section, which points to a very large dataset dump rather than a small combolist. The listing does not name the victim organization, limiting immediate attribution, but the scale suggests a substantial breach worth inspecting. Defenders should sample the archive to identify affected accounts and domains.LeakPriority 44
Registros de stealer del portal gubernamental Prakerja (Indonesia)User Mellirix posted 'Logs Prakerja Go.id Form Stealerlogs' on DarkForums on 11 November 2026, referencing infostealer credentials captured on the Indonesian government Prakerja training portal. The logs likely expose applicant and staff credentials tied to a .go.id domain. Government programs using such portals should treat this as a credential-compromise risk requiring reset and review.LeakPriority 48
Filtración de 140 millones de registros de Chaoxing XuexitongUser Amirxx60 posted a 'Chaoxin Xuexitong 2026 140M Leak' on DarkForums on 11 November 2026, claiming a large dataset from the Chinese learning platform Chaoxing Xuexitong. The figure overlaps with earlier known breaches of this platform, so much of the data may be recycled rather than new. It remains a large education-sector PII exposure but is of limited urgent relevance for Latin American defenders.LeakPriority 52
Conjunto de bases de datos de dominios .es de España a la ventaUser Mellirix advertised 'Spain .es databases' on DarkForums on 11 November 2026, offering collections of data from Spanish .es websites. Depending on scope, this can expose user accounts and personal data tied to Spanish organizations and consumers. Spanish defenders should treat it as a possible credential and PII exposure pending verification.