BRIEFLeaklowP42
Massive 656 million-line credential combolist for sale
Detected5 October 2026 · 14:34 UTC
A threat actor is selling a 656,289,112-line MAIL:PASS credential list covering USA, France, Germany and UK accounts on a hidden forum. The sheer scale makes it a ready-made resource for credential stuffing and account-takeover campaigns at volume. Defenders should enforce MFA and watch for password-spray activity against corporate mail, though the dump is generic rather than tied to a specific organization.
CategoryLeak
Severitylow
Priority score42
Detected5 October 2026 · 14:34 UTC
Leak● 56
A la venta lista de 700.000 clientes de Coinbase de varios paísesA seller advertises a Coinbase lead set of about 700,000 records across many countries, dated late September 2026. If genuine it supplies names and contacts that fuel phishing and account-takeover against crypto users. Worth flagging for financial defenders, though it may be scraped rather than breached data.Leak● 72
Base de datos de Serasa Experian con 223 millones de brasileños a la ventaA seller offers a 1.8 TB dump of roughly 223 million Brazilian citizens' records from Serasa Experian, the country's largest credit bureau. It exposes CPF, addresses and financial profiles usable for identity theft and fraud targeting consumers and banks. Relevant to LATAM fraud monitoring even if it re-posts an older leak.Leak● 73
Base de datos de FuturizeSistemas (Brasil) con 6M de registros a la ventaA seller is offering a 6M+ record database attributed to the Brazilian company FuturizeSistemas, tagged 2026. A dataset of this size enables credential stuffing, phishing and large-scale fraud against Brazilian users. It matters for AR-LATAM defenders as a fresh, high-impact corporate leak in the region.Leak● 50
Base de datos de 430.000 usuarios de Dubizzle (EAU) a la ventaA seller on BreachForums offers a 430,000-user profile database from Dubizzle (UAE), including emails, phones, and transactions. It is a large leak of a real e-commerce platform, though outside Latin America. Regionally it mainly serves as a reference for resold e-commerce data, with limited direct impact.Leak● 58
Filtración de base de datos del centro médico CEMADOJA (Rep. Dominicana)DarkForums lists a leak attributed to the Centro de Educación Médica de Amistad Dominico-Japonesa (CEMADOJA), a Dominican Republic medical and education entity. The exact date is not visible, but it is a real regional organization's database. Exposure of medical and personal data is sensitive under health rules and enables fraud and social engineering.Leak● 72
Filtración de base de datos de dispositivos de empleados en ColombiaAn actor posted on DarkForums a database labeled 'Colombia_Employee_Device_Registration' with employee and device records from a Colombian entity. The posting is fresh (minutes before detection), raising the risk of immediate abuse. For a regional defender it exposes internal data that enables targeted phishing and corporate network access.