BRIEFGov / MilitarycriticalP95
Database leak of Spain's CNI and CN-CERT
CNI / CN-CERT (España)
Detected26 September 2026 · 18:16 UTC
A database purportedly belonging to Spain's Centro Nacional de Inteligencia (CNI) and its CN-CERT is being offered on a dark-web forum. If genuine, it exposes national intelligence and incident-response contacts, an extremely sensitive target for a NATO/EU member state. Defenders should treat it as a potential enabler of spear-phishing and credential abuse against Spanish government entities.
CategoryGov / Military
Severitycritical
Priority score95
Detected26 September 2026 · 18:16 UTC
Gov / MilitaryPriority 80
Filtración de base de datos del SSO de CAPES (Brasil)A listing on DarkForums advertises a database tied to the CAPES single-sign-on (sso.capes.gbr), a Brazilian federal education agency, containing over 4M emails, 4M+ phone numbers and 1M+ bank details. If genuine, this is a large exposure of government-linked personal and financial data of Brazilian academics and staff. It enables phishing, credential stuffing and serious regulatory exposure.Gov / MilitaryPriority 74
Brecha de datos en el organismo ambiental de Roraima (FEMARH)A thread on xReactor advertises a data breach of FEMARH, the Roraima state environmental and water-resources agency hosted on a .rr.gov.br government domain. Compromise of a public agency exposes citizen and internal records and can enable further intrusion into government systems. Government data leaks matter for public-sector defenders in Brazil.Gov / MilitaryPriority 65
Filtración de datos del gabinete del Primer Ministro de ItaliaA seller on DarkForums (user 'Rozwawyn', posted 14 Oct 2026) is offering leaked data attributed to the Italian Prime Minister's Office. Government data of this kind can expose internal communications, staff PII and sensitive policy material. Though the post is a few weeks old, any confirmed leak of a national executive body warrants verification and monitoring.Gov / MilitaryPriority 66
Filtración de datos del gobierno de la ciudad de Augusta (augustaga.gov)A leak of data from the City of Augusta, Georgia (augustaga.gov) was posted on DarkForums on 14 October 2026. A municipal government breach can expose citizen records and internal systems. Although outside LATAM, it is a fresh public-sector leak worth monitoring for potential data reuse.Gov / MilitaryPriority 63
Base de datos RENAPER (DNI) de Argentina filtrada, ~19M personasA DarkForums thread offers roughly 19M full personal records from Argentina's RENAPER national identity registry, including DNI data. RENAPER underpins national ID issuance, so this data fuels identity fraud, account takeover and government-service impersonation. No fresh date is visible and it closely resembles the historic 2021 RENAPER breach, so it may be a reposted dataset rather than a new compromise.Gov / MilitaryPriority 90
Base de datos del RENAPO de México a la ventaThreat actor 'cutzinger' is advertising on DarkForums what is claimed to be a database from Mexico's RENAPO national population and identity registry. RENAPO holds CURP, full names, birth dates and identity records for the entire Mexican population, so a genuine dump enables mass identity fraud and impersonation. Mexican government bodies and financial institutions should urgently verify authenticity and assess exposure.