BRIEFLeakcriticalP85
Database leak of Pernambuco state hits 9 million residents
Gobierno del Estado de Pernambuco (Brasil)
Detected17 September 2026 · 05:12 UTC
A database covering roughly 9 million residents of the Brazilian state of Pernambuco is being offered on BreachForums, likely including full names, CPF/ID numbers, addresses and contact data from state registries. This is a government breach in Latin America, so the data can fuel identity fraud, social engineering and targeting of public services. Defenders in the region should assume the records are exposed and prepare for credential-stuffing and phishing against citizens.
CategoryLeak
Severitycritical
Priority score85
Detected17 September 2026 · 05:12 UTC
Leak● 62
Filtración de datos del prestamista hipotecario New American FundingOn 31 October 2026 the actor Jarkilon published a 'New American Funding leak' database thread on DarkForums, naming the large US mortgage lender. The listing implies borrower and applicant PII — names, contacts and loan/financial data — was exfiltrated, a high-value asset for phishing and identity fraud. US financial-sector defenders and the lender's customers should treat the data as exposed.Leak● 65
Ministerio del Interior de Taiwán: base de 23,57M de ciudadanosBreachForums sellers listed a 'full citizens' extract of Taiwan's Ministry of the Interior register, claiming 23.57 million records at 100% coverage (now marked sold out). If genuine, it exposes national ID, address and household data for essentially the entire adult population, enabling identity fraud and social engineering. Taiwanese government bodies and any service relying on citizen-ID verification should treat this data as compromised.Leak● 56
Base de datos de la promotora malasia Mah Sing Group a la ventaThe actor scarlettgroup posted a database belonging to Mah Sing Group Berhad (mahsing.com.my), a major Malaysian property developer, on DarkForums on Sunday 1 November 2026. Dumps of this type typically contain customer, sales and employee records useful for targeted phishing and fraud. Malaysian real-estate firms and the company's customers should verify the leak and monitor for misuse.Leak● 62
Base de datos del diario uruguayo la diaria a la ventaA cybercriminal thread on an onion forum advertises a database belonging to la diaria, a Uruguayan independent newspaper (ladiaria.com.uy). The thread is login-walled so the record count and price are unknown, but a media outlet in the region is a plausible target for subscriber and staff credential exposure. Leaked newsroom or subscriber data enables phishing against journalists and can be reused for account takeover.Leak● 30
Publicada una brecha de sitios .gov.ma (Marruecos)The actor 'fexus' posted a thread on BreachForums titled '.gov.ma websites breach', indicating data from Moroccan government sites. However, the post is dated mid-May 2026, roughly six months before today, so it is not a fresh alert and the specifics of the leak are not detailed in the captured text. It is a government-sector exposure but outside the Argentina/LatAm focus and already stale.Leak● 45
Filtración de 200.000 credenciales corporativas de Alemania (D4RKNETHUB)The D4RKNETHUB actor is distributing 'Part (6)' of a dataset containing roughly 200,000 German corporate email:password records, reposted across several forums including DarkNetArmy, Niflheim and HARD-TM. These mail:pass combos are directly usable for credential stuffing, account takeover and business email compromise against German companies. Fresh corporate credential sets like this are actively exploited for phishing and unauthorized access.