BRIEFLeakhighP72
Database leak of Ecuador's Aviation
Aviación de Ecuador
Detected10 September 2026 · 22:12 UTC
A BreachForums thread claims the actor TerroahOver dumped a database belonging to Ecuador's aviation body, a government/military-linked entity. If authentic, it exposes sensitive personnel or operational data of a LatAm state target and risks credential reuse, phishing and further intrusion. Defenders should verify scope and monitor for downstream abuse.
CategoryLeak
Severityhigh
Priority score72
Detected10 September 2026 · 22:12 UTC
Leak● 28
Filtración de 5 millones de registros de clientes de SFRA database of about 5 million records attributed to French ISP SFR continues to be re-shared on leak forums. The thread is clearly old (a page-26 reply to a long-running post), so it is not a fresh incident, but the data still fuels phishing and account-takeover against subscribers. Treat it as background context rather than a new alert.Leak● 55
Filtración de 6,5M de correos de usuarios de JamendoA scraped dataset of roughly 6.5 million Jamendo user email addresses and linked account data was published in 2026. While Jamendo is a music platform rather than critical infrastructure, the volume makes it a strong base for credential-stuffing and phishing campaigns against users worldwide. Organizations should check whether employee or corporate-linked accounts appear in the set.Leak● 58
Filtración de base de datos de pasaportes e identidades de IsraelA threat actor posted a claim of a full database of Israeli passports and identity documents in the 2026 leaks section of the SpyHackerz forum. Passport and identity data enable large-scale identity theft, document forgery and targeted fraud. Although outside the AR-LATAM region, the volume and sensitivity justify monitoring for reuse of the data against regional targets.Leak● 92
Base de datos del banco mexicano MEXBANK a la ventaA seller posted a 'MEXBANK' database from Mexico (2026) minutes ago in an unverified seller section. It appears to be customer or account records from a Mexican financial institution. Fresh LATAM banking-data leaks require immediate validation and notification planning.Leak● 32
Volcado de 5 millones de credenciales de stealer (url:log:pass)Actor 'Napoleon' posted a fresh dump of roughly 5 million url:log:pass stealer-log entries, part of an ongoing series of high-volume credential leaks. The volume makes it a sizable corpus for credential stuffing and account takeover, though no specific organization or region is identified. It carries no evident government or LATAM critical-infrastructure relevance.Leak● 40
Filtración de la base de datos de la tienda online de SFR (583k)A ~583,000-record dump of boutique.sfr.fr, the e-commerce site of French telecom operator SFR, is circulating on a breach forum. Telecom is critical national infrastructure, so customer PII and order data can power phishing, account takeover and SIM-swap fraud. The thread dates to January 2026, so it is a stale leak, not a fresh breach.