BRIEFLeaklowP24
Leak of 2.1M private URL:LOG:PASS credentials
Detected22 September 2026 · 12:01 UTC
A private 2.1-million-line URL:LOG:PASS credential dump was posted to DarkForums. Dumps this size fuel credential-stuffing across many services and can contain valid corporate logins. However, the post dates to July 2025, so the data is stale and now of mostly background value for defenders.
CategoryLeak
Severitylow
Priority score24
Detected22 September 2026 · 12:01 UTC
LeakPriority 55
Base de datos de Binance de 335 millones de registros a la ventaA seller ('Felixben') on DarkForums posted on November 5, 2026 offering a claimed 335-million-record Binance database labelled '2026'. If genuine it would expose customer KYC and account data at one of the world's largest crypto exchanges; however, large 'Binance database' claims are frequently recycled or fake, so defenders should verify before reacting.LeakPriority 50
Alegado volcado de la base de datos de usuarios de IKEAA DarkForums user (XOUCAO, November 2026) posted a thread claiming to hold IKEA's user database with all customer personal information. The post shown includes no sample, record count or proof of access, so the claim is unverified and could be recycled or fabricated data. Retail customer databases of this size are valued for credential stuffing and targeted phishing campaigns.LeakPriority 60
Filtración de la base de datos interna de la Universidad Uniguaçu (Brasil)An actor on the Spear/Spear4h underground forum published an 'internal database dumped' entry attributed to Universidade Uniguaçu, a private Brazilian university; the thread is login-walled, so record counts and data types are not visible. University internal databases normally hold student, staff and financial records that fuel phishing and fraud. Brazilian education institutions are frequently targeted, so the claim should be verified directly with the institution.LeakPriority 56
Base de 17 millones de perfiles de Instagram de EE. UU. obtenida por API a la ventaA seller on DarkForums is offering a 17 million record dataset of US instagram.com accounts obtained through API scraping, dated 2026. While it likely contains profile and contact metadata rather than credentials, at this scale it fuels targeted phishing, SIM-swap pretexting and account-takeover attempts against high-profile users. Defenders should treat exposed emails and phone numbers as compromised identifiers.LeakPriority 66
Filtración de 120,7 millones de registros del sector educativo de São PauloA dataset labelled 'Brazil SP EDUCATION' with 120.7 million records was published on DarkForums, one of the largest Latin American education leaks seen. It exposes personal data of students, teachers and staff in São Paulo state, usable for phishing, identity fraud and credential stuffing. The thread now appears closed/removed, so it may be a repost of an older dump — verify freshness before alerting.LeakPriority 55
Presunta filtración de datos de contratistas militares y de gobiernoA DarkForums post claims a 'fresh breach' full data dump of 100M+ records attributed to Raptor Supplies, described as covering military, government and civilian contractors. The claim is unspecific and resembles aggregator-style marketing, so scale and authenticity are unconfirmed. If genuine, contractor credentials and procurement data could expose supplier accounts used by defence and public-sector buyers.