BRIEFLeakcriticalP90
400 GB data leak of Cancún municipal government (cancun.gob.mx)
Ayuntamiento de Cancún / cancun.gob.mx
Detected15 November 2026 · 20:13 UTC
The user 'arcepah' published a 400 GB database allegedly belonging to the Cancún municipal government (cancun.gob.mx) on DarkForums on 15 November 2026. Municipal data can include citizen records, internal documents and credentials, enabling identity fraud and follow-on intrusion into government systems. Defenders should verify the leak against exposed assets and watch for credential reuse.
CategoryLeak
Severitycritical
Priority score90
Detected15 November 2026 · 20:13 UTC
LeakPriority 55
Filtración de la base de datos SpainDB con 300.000 personasOn 15 November 2026 the user 'syx171' published 'SpainDB', a database covering roughly 300,000 Spanish individuals, in the DarkForums leak section. Population data of this kind typically fuels phishing, identity fraud and credential-stuffing against banks and online services. Spanish organizations should check whether their users appear in the dataset and warn affected customers.LeakPriority 50
Filtración de 6,9 millones de credenciales URL:LOG:PASSActor cloudmarket_pro published a 6.9 million line URL:LOG:PASS dataset labelled private and UHQ on DarkForums in November 2026, and the same dump is being reshared on other forums. Each line maps a login URL, username and plaintext password, which is directly usable for credential stuffing against corporate VPNs, webmail and SaaS portals. Because the scope is not segmented by organization, defenders must assume employees of any sector may be included.LeakPriority 56
Filtración de la base de datos de la Universidad de MadridOn 15 November 2026 the actor syx171 published a 'DATABASE Universidad Madrid' thread on DarkForums, the same account that posted a Spanish hospital dump minutes earlier. The dump likely contains academic and staff accounts plus personal data of students, which enables phishing and credential stuffing against university services. The duplicate thread posted two minutes later suggests active promotion of the same dataset.LeakPriority 63
Filtración de base de datos de un hospital de EspañaThe user 'syx171' posted on DarkForums on 15 November 2026 a database allegedly belonging to a Spanish hospital. Healthcare records are highly sensitive and valuable for fraud and extortion, and a breach can expose patient and staff data. Spanish health-sector defenders should confirm the scope and monitor for downstream misuse.LeakPriority 55
Colección de datos SCADA de EE. UU. publicada en BreachForumsA data collection labeled 'BhriguOne Scada US' was posted on BreachForums by user waykurap on 15 November 2026. If authentic, bundling SCADA/ICS-related data for US industrial targets raises risks for operational technology operators and vendors. Though outside the AR-LATAM focus, it is a fresh, time-sensitive critical-infrastructure leak worth tracking.LeakPriority 62
Filtración de declaraciones patrimoniales de funcionarios de MéxicoA database of 'declaraciones patrimoniales' (asset declarations) of Mexican public officials was leaked on DarkForums by user SoftVoid. Such records expose officials' income, properties and family assets, enabling targeting, extortion and corruption profiling. Mexican government bodies should confirm the source and warn affected officials.