BRIEFLeaklowP40
402K-record leak of French hotel chain Belambra
Belambra
Detected14 November 2026 · 21:13 UTC
The actor ChimeraZ published a 402,000-record database attributed to Belambra.fr, a French holiday-village and hotel operator, in the DarkForums databases section. The post is dated 16 May 2026, so it is roughly six months old and not a fresh alert, but the dump may still circulate and be reused for phishing and credential stuffing against the company and its guests. Customer contact, booking and possibly partial payment details are the typical exposure in this kind of dump.
CategoryLeak
Severitylow
Priority score40
Detected14 November 2026 · 21:13 UTC
LeakPriority 70
Filtración gratuita de base de datos de la red de salud Subred Norte de ColombiaOn DarkForums, a user named Synq1xxss is distributing free of charge a 173k-line dataset attributed to Subred Norte, a public health services network in Bogotá, Colombia. Health-sector records can expose patient and staff personal data, enabling phishing, identity fraud and downstream social-engineering attacks. It is a fresh release tied to a real Latin American critical-sector entity, so it warrants prompt review.
LeakPriority 89
Filtración de datos de licencias de conducir de la ANSV de ArgentinaA threat actor using the handle skyling published on BreachForums a database allegedly containing Argentine driver's license records attributed to ANSV, the national road safety agency. This kind of dataset typically holds names, DNI, license numbers and personal identifiers that enable identity theft, credential abuse and highly targeted phishing. The fresh posting on a national government body in Argentina makes it a priority for defenders and authorities.LeakPriority 62
Filtración de base de datos de la Universidad Celso Lisboa (RJ)Actor Duk3nk published on DarkForums on 14 November 2026 a database belonging to Celso Lisboa University in Rio de Janeiro, Brazil. University datasets usually hold student and applicant personal data, contact details and possibly academic and financial records, which fuel phishing and identity theft. The leak is recent and the data may already be circulating among buyers.LeakPriority 65
Filtración de datos de la plataforma educativa Educastur (España)User karsovx posted on DarkForums on 14 November 2026 a database apparently taken from Educastur, the public education platform of the Principality of Asturias in Spain. The data would cover students, teachers and staff accounts tied to a public service, enabling credential stuffing and convincing phishing. Public-sector education records carry data-protection obligations and should be assessed now.LeakPriority 68
Filtración de datos de 12.000 pacientes de la clínica INTELMEDActor Synq1xxss posted a database attributed to the Latin American clinic INTELMED with roughly 12,000 patient records on DarkForums on 15 November 2026. Health records of this kind fuel medical fraud, identity theft and extortion of patients. Regional clinics and insurers should check whether their data is in the dump and review access controls on patient systems.LeakPriority 40
Base de datos de 500.000 usuarios de Rainbet a la ventaA BreachForums seller is advertising a mail list of roughly 500,000 Rainbet users, an online crypto casino, as a standalone database for sale. The listing gives no date or sample, so the database may be scraped or partly stale, but it targets gambling accounts that are prime material for credential stuffing and account takeover. Betting users are also frequent targets of phishing and payment fraud.