BRIEFLeaklowP45
Database leak of Mexico's National Polytechnic Institute (ipn.mx)
Instituto Politécnico Nacional (IPN), Mexico
Detected7 November 2026 · 06:43 UTC
User s4100n published a database titled 'ipn.mx' in the Leaks/Databases section of DarkForums, referring to the domain of Mexico's Instituto Politécnico Nacional, a public national education institution. The thread dates from 10 June 2026, so it is already several months old, and neither the record count nor the data fields are disclosed. Leaked academic and staff records from a public institution enable credential stuffing, phishing and account takeover affecting students and employees.
CategoryLeak
Severitylow
Priority score45
Detected7 November 2026 · 06:43 UTC
LeakPriority 42
Base de datos con PII de clientes mexicanos de Cosmotienda filtradaPoster 'Jaded' shared a Freebie on BlackBones Carding Forum advertising what is described as a 2026 Mexican PII database belonging to Cosmotienda, a Mexican cosmetics retailer. The post dates from 23 August 2026 and no record count, data fields or sample are provided, so the real scale is unverified. Customer PII of Mexican consumers supports phishing, identity fraud and account takeover, and triggers data-protection obligations for the retailer.LeakPriority 40
Filtración de base de datos del Partido Baaz de Irak y SiriaA database attributed to the Iraq/Syria Socialist Ba'ath Party was offered for download on BreachForums, potentially exposing membership or personnel records of a politically sensitive organization. The post provides no clear date or record count, so its recency and scale cannot be confirmed. It is mainly relevant for regional political-risk and counter-intelligence monitoring rather than for AR-LATAM defenders.LeakPriority 48
Publican 18.000 cuentas de Coinbase filtradasA set of roughly 18,000 Coinbase accounts was published on DarkForums by user Zannokar on November 1, 2026 in the cracked-accounts section. Crypto exchange accounts are prime targets for account takeover and direct theft, and leaked credentials fuel credential-stuffing and phishing against users. The moderate size limits impact but the financial sector should watch for credential reuse.LeakPriority 74
Filtración de 7,4 millones de registros de Apteka.ruA 7.4 million record database belonging to Apteka.ru, a major Russian online pharmacy, was posted for download on DarkForums by user UNC6783 on November 7, 2026. Pharmacy databases typically hold customer names, contact details, addresses and order/health-related data, creating a high-value privacy and fraud exposure. Defenders should treat this as a fresh, large-scale leak relevant to credential-stuffing and phishing campaigns.LeakPriority 45
Filtración de base de datos del gobierno de Irak (rss.gov.iq, 100 GB)A xReactor.org thread references a 100GB leak of the rss.gov.iq government database dated August 2026. If genuine, it represents a substantial exfiltration of Iraqi public-sector records with potential PII and account data. It is dated a few months back and concerns a non-LATAM target, so it is relevant mainly as background rather than a fresh alert for AR-LATAM defenders.LeakPriority 88
Base de datos completa del Gobierno de Paraguay a la ventaA BreachForums (bf.st) thread advertises a 'FULL DATABASE GOVERNMENT PARAGUAY,' implying a large-scale exfiltration of Paraguayan public-sector records. If authentic, it could expose citizen PII, internal accounts and administrative data across state entities. This is a high-value LATAM government leak that defenders must verify immediately and track for downstream fraud.