BRIEFLeakhighP50
6.9 million URL:LOG:PASS credentials leaked
Detected15 November 2026 · 19:13 UTC
Actor cloudmarket_pro published a 6.9 million line URL:LOG:PASS dataset labelled private and UHQ on DarkForums in November 2026, and the same dump is being reshared on other forums. Each line maps a login URL, username and plaintext password, which is directly usable for credential stuffing against corporate VPNs, webmail and SaaS portals. Because the scope is not segmented by organization, defenders must assume employees of any sector may be included.
CategoryLeak
Severityhigh
Priority score50
Detected15 November 2026 · 19:13 UTC
LeakPriority 56
Filtración de la base de datos de la Universidad de MadridOn 15 November 2026 the actor syx171 published a 'DATABASE Universidad Madrid' thread on DarkForums, the same account that posted a Spanish hospital dump minutes earlier. The dump likely contains academic and staff accounts plus personal data of students, which enables phishing and credential stuffing against university services. The duplicate thread posted two minutes later suggests active promotion of the same dataset.LeakPriority 63
Base de datos de un hospital de España publicada en DarkForumsUser syx171 posted a thread titled 'DATABASE Hospital Spain' on DarkForums on 15 November 2026 offering a database dump attributed to a hospital in Spain. The record count and sample are not yet public, so the exact scale is unconfirmed, but healthcare data typically includes patient identifiers and contact details. Spanish health organizations should check the sample against their own systems and watch for follow-up extortion.LeakPriority 55
Colección de datos SCADA de EE. UU. publicada en BreachForumsA data collection labeled 'BhriguOne Scada US' was posted on BreachForums by user waykurap on 15 November 2026. If authentic, bundling SCADA/ICS-related data for US industrial targets raises risks for operational technology operators and vendors. Though outside the AR-LATAM focus, it is a fresh, time-sensitive critical-infrastructure leak worth tracking.LeakPriority 62
Filtración de declaraciones patrimoniales de funcionarios de MéxicoA database of 'declaraciones patrimoniales' (asset declarations) of Mexican public officials was leaked on DarkForums by user SoftVoid. Such records expose officials' income, properties and family assets, enabling targeting, extortion and corruption profiling. Mexican government bodies should confirm the source and warn affected officials.LeakPriority 74
Filtración de 22.077 archivos de la Secretaría de Salud de TamaulipasA 22,077-file document dump attributed to the Secretaría de Salud de Tamaulipas (Mexico) was published on DarkForums. Government health records can include patient, staff and procurement data useful for fraud, doxxing and follow-on intrusion. Defenders in Mexican public health should verify the scope and notify affected parties.LeakPriority 48
Filtración de datos SCADA de EE. UU. atribuida a BhriguOneA BreachForums user using the handle 'waykurap' posted a 'BhriguOne Scada US' leak on 15 November 2026 in the Other Leaks section. It claims to expose SCADA/industrial control data tied to US organizations, though the exact victim and record volume are not confirmed in the preview. Industrial-control data is high-risk because it can reveal credentials, network topology and control-system access for follow-on intrusions.