BRIEFLeakhighP55
75M URL:login:password credentials leaked in private dump
Detected18 October 2026 · 14:12 UTC
A private, freshly posted ULP dump contains roughly 75 million URL:login:password stealer-log entries dated 18/10/2026. Because stealer logs pair valid credentials with the exact site they unlock, they fuel credential stuffing and initial access against both consumer and corporate accounts. Defenders should assume exposed credentials will be replayed and prioritize password-reset and MFA checks on any matched domains.
CategoryLeak
Severityhigh
Priority score55
Detected18 October 2026 · 14:12 UTC
Leak● 88
Filtración de base de datos RGAE del Ministerio de Finanzas de GuatemalaA threat actor is leaking the RGAE database from Guatemala's Ministry of Finance, containing roughly 130,000 records plus about 235,000 PDF documents. Taxpayer and financial records of a government body make this a high-value exposure for fraud, phishing and identity theft. Defenders in Guatemalan public finance should verify the claim and monitor for downstream abuse.Leak● 38
Base de datos de 200.000 clientes de ekiba.de a la ventaA roughly 200,000-record database of the German company ekiba.de, containing phone numbers and emails, is being sold on the BreachForums marketplace. The scale is modest and limited to contact data, but paired phone and email enables SMS/voice phishing and smishing against customers. A real but low-impact commercial leak rather than a critical-infrastructure or access event.Leak● 40
Combolist VIP de 1,3 millones de credenciales URL:login:passwordA contributor released about 1.3 million URL:login:password entries taken from a private VIP section, dated 10/17/2026. The volume is moderate and the content is generic credential material rather than a targeted breach of a specific organization. Still, matched URL:login pairs can seed account takeover attempts, so watch any corporate domains that appear.Leak● 38
Filtración de base de datos de Telekom Serbia con más de 650.000 registrosForum users are sharing a 650,000+ line database attributed to Telekom Serbia, a national telecom operator. If genuine it exposes subscriber and account data of a critical-communications provider. The post dates to March 2026, so it is not a fresh alert, but it remains useful for historical exposure and password-reuse tracking.Leak● 66
Base de datos de la utility ginebrina SIG a la ventaA seller in the BreachForums marketplace is offering a database attributed to Services Industriels de Genève (SIG), the Swiss utility that supplies water, electricity, gas and telecom to the Geneva canton. Record count and exposed fields are not disclosed, but any dump of customer or staff data enables targeted phishing and credential abuse against a critical-infrastructure operator. Treat it as an unconfirmed but credible lead for energy/water-sector defenders.Leak● 28
Repost: 3 millones de registros de débito de EE. UU. a la ventaA 3M-record US debit-leads dataset was reposted on BreachForums, dated 31 May 2026. It is a repost of already-circulated financial leads rather than a new breach, limiting its freshness. Still relevant for fraud-monitoring teams tracking exposed cardholder/debit data, but not a new alert.