BRIEFLeakhighP76
31 million records from France's CAF leaked
CAF.fr (Caisse d'Allocations Familiales, Francia)
Detected4 November 2026 · 21:24 UTC
DarkForums user Qelsusek posted a 31.1 million-record dataset labelled CAF.FR 2026, referring to France's family benefits agency, one of the largest social-security databases in Europe. The scale implies national coverage of beneficiaries and would be highly valuable for social engineering and benefit fraud. Defenders outside the region should treat it as a benchmark of how large public-sector data is being monetised.
CategoryLeak
Severityhigh
Priority score76
Detected4 November 2026 · 21:24 UTC
Leak● 28
Base de datos de Canva reeditada en foro de filtracionesA thread offering a Canva.com database was posted on DarkForums on 4 November 2026 by user Soldeitoz. Canva suffered a well-known large breach years ago, so this is likely a re-post of stale data rather than a new incident. It is worth noting for re-use in credential-stuffing but is not a fresh compromise.Leak● 52
Filtración de la base de datos de ZenMobile FranciaA database belonging to French telecom ZenMobile was posted on DarkForums on 4 November 2026 by user Soldeitoz. Telecom customer data often includes subscriber identities, contact details and usage information valuable to fraud and SIM-swap actors. Telecom breaches also carry regulatory and customer-trust impact.Leak● 56
Filtración de datos de la Asociación Médica TurcaA leak concerning the Turkish Medical Association (TTB) was posted on DarkForums on 4 November 2026 by user hasoo. As a national medical professional body, exposed data may include member, physician or contact information. Health-sector leaks enable targeted phishing and raise privacy and regulatory concerns.Leak● 68
Filtración completa de BMW publicada en 13 partesA complete BMW corporate data leak released in 13 parts was posted on DarkForums on 4 November 2026 by user Soldeitoz, indicating a large multi-part database exposure. The affected party is a major German automotive manufacturer, so the data may include internal, customer or supplier records. Automotive and supply-chain defenders should assess exposure as the parts are published.Leak● 42
Filtración de 200.000 registros del portal de GuanajuatoA DarkForums listing advertises a 200K-record database from guanajuato.gob.mx, the Mexican state government portal. The thread is closed as removed content and carries no visible date, so freshness cannot be established and the data may already be circulating for some time. It remains relevant as part of a cluster of Mexican state-portal leaks alongside Durango and Sonora.Leak● 45
Base de datos completa del portal de Sonora expuesta en DarkForumsA DarkForums thread by Frouzenx advertises a full database from sonora.gob.mx, the Mexican state government portal, without a verifiable record count. The listing is closed as removed content and the exact posting date is unclear, making freshness uncertain. It still indicates continued targeting of Mexican state portals and should be correlated with the Durango and Guanajuato postings.