BRIEFLeakhighP60
1300 GB KYC data leak with ID documents and selfies
Detected12 November 2026 · 12:13 UTC
A seller on DarkForums is advertising a roughly 1300 GB trove of KYC records comprising ID cards, passports, driver's licenses and matching selfies from an unidentified source. This scale of verified identity documents fuels account takeover, loan fraud and onboarding bypass for banks, fintechs and crypto platforms. Defenders should watch for reuse of their customers' documents and tighten liveness and document-verification checks.
CategoryLeak
Severityhigh
Priority score60
Detected12 November 2026 · 12:13 UTC
LeakPriority 57
Base de datos de jd.com China a la venta en DarkForumsSeller 'araragi' on DarkForums is offering a database attributed to Chinese e-commerce giant JD.com. If genuine, it would contain large volumes of customer records including contact and possibly order data. This is a high-profile retail data sale relevant to fraud and account-takeover monitoring.LeakPriority 60
Base de datos de 111 millones de usuarios de Notion a la ventaUser 'chara' on DarkForums is selling a claimed 111-million-record database of Notion users. A leak of that scale would expose large volumes of corporate emails and account identifiers widely used across businesses. Any organization using Notion should treat this as a potential credential and data-exposure event.LeakPriority 62
Base de datos de DiDi China con 910 millones de registros a la ventaSeller 'tet' on DarkForums is offering a purported 910-million-record database attributed to Chinese ride-hailing giant DiDi. The scale is enormous and, if genuine, would represent one of the largest corporate data sales seen this period. Even outside the region it matters for credential-exposure and identity-fraud monitoring at global scale.LeakPriority 52
Filtración de base de datos del partido turco Yeniden RefahA 661,859-record database attributed to the Turkish Yeniden Refah Party is being sold on BreachForums, reportedly including member details. Political membership data is highly sensitive and enables targeted phishing, coercion and doxxing of members. Turkish political and civil-society entities should treat member lists as compromised.LeakPriority 55
Base de datos CRM de brokers Forex Admirals y MTrading a la ventaThreat actors are selling CRM data tied to the forex and crypto brokers Admirals and MTrading (platform Nsuite.in), likely containing client KYC and account details. Financial customer data fuels account takeover, social engineering and targeted fraud against investors. The brokers and their clients should verify exposure and reset credentials where applicable.LeakPriority 60
Base de datos de Azerbaijan Airlines y vuelos de pasajeros a la ventaA seller on DarkForums is offering the Azerbaijan Airlines (azal.az) database together with passengers' upcoming flight details, exposing PII and travel schedules of a national carrier. Such data enables targeted phishing, impersonation and physical-security risks for travelers and staff. The airline and its partners should treat customer and flight records as compromised.