BRIEFLeakhighP71
Colombian ID cards, selfies and tax numbers offered for sale
Ciudadanos colombianos (documentos de identidad)
Detected21 October 2026 · 09:39 UTC
The listing advertises Colombian national ID cards (front and back), video selfies and tax numbers, a full KYC package for identity fraud. This combination defeats most remote onboarding checks used by banks, fintechs and telcos in Colombia. It enables synthetic-identity account opening, credit fraud and impersonation at scale across the region.
CategoryLeak
Severityhigh
Priority score71
Detected21 October 2026 · 09:39 UTC
Leak● 46
Base de datos de la brasileña FoodPlus ofrecida en foro clandestinoA leak-forum thread advertises a database dump for foodplus.com.br, a Brazilian food-sector company. Details are behind a login wall, so the record count, date and fields are unknown, but customer or order data from a .com.br retailer is usable for phishing and card fraud. Worth monitoring as a possible LatAm commercial breach rather than a confirmed incident.Leak● 58
Base de datos de Genesys Cloud Services filtrada y distribuidaMultiple forums are circulating a downloadable database attributed to Genesys Cloud Services, a major contact-center and CCaaS provider used by banks, telcos and public agencies. A leak from such a vendor is a supply-chain concern: tenant data, support contacts and credentials could feed downstream targeting of its customers. Scale and date are unverified, so treat it as a lead to validate rather than a confirmed breach.Leak● 74
Venta de 15 millones de registros de la energética alemana E.ONA seller is offering roughly 15 million customer records belonging to E.ON, one of Europe's largest energy utilities, in a freshly posted thread. Data of this scale on an electricity/gas operator fuels billing fraud, phishing and account-takeover campaigns against critical infrastructure customers. Even outside LatAm it is a benchmark case for energy-sector exposure and supply-chain risk.Leak● 48
Venta de paquete de leads de Argentina con DNI y correoA seller is offering a leads package combining Argentine DNI numbers with email addresses on DarkForums. This kind of national-ID-linked contact data fuels targeted phishing, account takeover and identity fraud against Argentine residents. While scope is unconfirmed, DNI-plus-email pairing is highly useful for credential and smishing campaigns, so it merits monitoring.Leak● 63
Filtración gratuita de datos de Plus Ultra Líneas AéreasA free release labeled Plus Ultra Airlines, an operator flying between Venezuela, Spain and Latin America, is being distributed on DarkForums. Airline datasets typically contain customer PII, passports and booking details useful for phishing and identity fraud. The airline operates cross-region routes, raising exposure for passengers across Latin America and Spain.Leak● 30
Acceso a GitLab de gobiernos de varios países (filtración de 2024)A 2024 thread claims leaked GitLab access for multiple national governments, without naming the affected tenants. GitLab access typically yields source code, CI/CD secrets and internal tickets for public-sector projects, which is why it was heavily discussed at the time. It is roughly two years old and unspecific, so it is useful only for victim identification, not as a live alert.