BRIEFLeakhighP72
Leak of 50 million URL:LOG:PASS stealer-log credentials
Secretline.top / StarLinkClouds
Detected13 September 2026 · 18:12 UTC
A massive free dump of over 50 million URL:login:password lines extracted from infostealer logs was published on the Spear onion forum. The volume and clean URL:LOG:PASS format make it directly usable for credential stuffing and session hijacking against corporate and consumer accounts. Defenders should assume widespread credential reuse exposure and enforce MFA/rotate secrets.
CategoryLeak
Severityhigh
Priority score72
Detected13 September 2026 · 18:12 UTC
Leak● 44
Combolist LUPIN de 30,4 millones de credencialesA VIP-section thread on the Spear forum, dated 29 October 2026 and titled 'LUPIN ULP 30 400 000', advertises roughly 30.4 million URL:login:password entries of global origin; the body is behind a login wall. At this scale the dump will feed credential stuffing against corporate VPNs, webmail and SaaS portals, including organizations in Latin America that reuse passwords. Treat it as a hygiene and detection problem rather than a targeted breach.Leak● 50
Base de datos de la revista Forbes publicada en foro criminalUser Torax2020 posted on DarkForums on 29 October 2026 a thread titled 'DATABASE Forbes', advertising a dataset attributed to the US business media outlet. The post gives no size, sample or proof, so scope is unconfirmed, but media subscriber and staff databases are routinely reused for credential stuffing and targeted phishing against journalists and corporate readers. Verify the claim and watch for resale or bundling into larger combolists.Leak● 56
Filtración de datos de 15.284 pacientes de hospital dominicanoForum user sameen published on DarkForums a database claimed to contain records of 15,284 people linked to Hospital IMG in the Dominican Republic, in the health sector. Although the volume is modest, the data appears to be patient-level information, which carries high sensitivity under health-privacy rules and enables medical fraud and targeted extortion. The post date is not explicit, so freshness should be confirmed before treating it as a new incident.Leak● 66
Base de datos del Partido Nacional de Uruguay, filtradaA newly registered user (ExPresidents) posted on the Spear forum a database attributed to Uruguay's Partido Nacional / Partido Blanco, a major national political party, with the thread dated October 2026. Political party databases typically hold member registries, voter contact lists, identity documents and staff accounts, making them valuable for phishing, influence operations and identity fraud. The material is fresh and directly relevant to Uruguayan political and electoral infrastructure.Leak● 74
Filtración de datos de la tecnológica argentina GlobantA DarkForums member (Eldvivin) published a thread on 26 October 2026 advertising a leak tied to Globant.com, the Argentine-founded IT services giant with heavy banking, telecom and government clients across Latin America. The post does not disclose scope or sample, but a confirmed breach of this provider would expose source code, client project data and credentials with downstream impact on regulated sectors in Argentina and the region. Triage the claim against internal logs and monitor for re-publication on ransomware leak sites.Leak● 44
Combolist de 1,4 millones de credenciales de correo de BrasilA login-walled thread advertises a 1.4 million line MailPass combolist focused on Brazil, the largest Latin American market. Such lists are usually aggregated from older stealer logs and website breaches rather than a new compromise, so freshness is uncertain, but they fuel credential stuffing against Brazilian banking, retail and government portals. Brazilian organisations should check for corporate domains in the list and enforce MFA.