BRIEFLeakhighP46
396,000 Spanish user email credentials leaked in fresh combolist
Detected8 November 2026 · 18:43 UTC
A large email:password combolist labelled for Spain with over 396,000 entries was posted as fresh (8-11-2026) across BreachForums, DarkForums and LeakForum. It targets Spanish-speaking users broadly rather than a single organization. Defenders in Spain should assume credential-reuse and phishing exposure for affected accounts.
CategoryLeak
Severityhigh
Priority score46
Detected8 November 2026 · 18:43 UTC
LeakPriority 72
Filtración de datos KYC de usuarios de TransakA threat actor on the DarkNetArmy forum is distributing KYC data of users of Transak, a global crypto fiat on-ramp, including identity documents and selfies. Such records enable identity theft, account takeover and regulatory exposure for the platform and its customers. Organizations in fintech and crypto should treat these identities as compromised.LeakPriority 40
Filtración de datos internos de la telco indonesia TelkomAn actor on DarkForums posted 228 records described as corporate accounts plus internal access data from Indonesian telecom Telkom (telkom.co.id), dated 2026. The volume is small, but internal-access credentials to a national operator could enable deeper intrusion if still valid. Indonesian telecom defenders should verify whether these accounts remain active.LeakPriority 68
Base de datos de clientes de Jazztel (Orange) a la ventaA seller on BreachForums is offering a database of over one million records allegedly tied to Jazztel, the Spanish telecom operator owned by Orange. If genuine, it exposes customer emails and credentials that enable credential stuffing and account takeover against a major Spanish telecom. Defenders should treat Jazztel customer accounts as potentially compromised.LeakPriority 56
Base de datos de más de 2 millones de registros de airship.co.uk a la ventaA seller in the BreachForums Leaks Marketplace is advertising a database of more than 2 million records attributed to UK company airship.co.uk. The listing does not fully detail the fields, but a dataset of this size typically contains customer and corporate contact data valuable for phishing and credential stuffing. Organizations whose users or partners relate to the firm should confirm whether their accounts appear.LeakPriority 60
Filtración de base de datos y pagos de la francesa mbsdesign.frThe actor 'Sophia' published on DarkForums a database allegedly taken from French company mbsdesign.fr, including payment transaction records. If genuine, it exposes customer identities, order details and payment data useful for card fraud and targeted phishing. Defenders tied to the merchant and its payment partners should verify scope and watch for misuse of the exposed records.LeakPriority 22
Filtración de datos de 1 millón de ciudadanos israelíes (junio de 2025)DarkForums user RuskiNet posted a dataset claimed to contain data on one million Israeli citizens, including national identity details. The post is dated June 2025, so it is more than a year old and has likely circulated widely since; it is not a fresh alert. It still has value for historical exposure checks of affected individuals rather than for immediate response.