BRIEFLeakcriticalP88
Guatemala Ministry of Finance RGAE database leak
Ministerio de Finanzas de Guatemala (RGAE)
Detected18 October 2026 · 14:50 UTC
A threat actor is leaking the RGAE database from Guatemala's Ministry of Finance, containing roughly 130,000 records plus about 235,000 PDF documents. Taxpayer and financial records of a government body make this a high-value exposure for fraud, phishing and identity theft. Defenders in Guatemalan public finance should verify the claim and monitor for downstream abuse.
CategoryLeak
Severitycritical
Priority score88
Detected18 October 2026 · 14:50 UTC
Leak● 50
Base de datos de subsidios de SEDEM Bolivia filtrada en un foroA moderator on Spear Leaks posted a database attributed to SEDEM, the Bolivian state entity managing productive and social subsidy programmes. The file appears to include beneficiary data, which is highly exploitable for fraud, impersonation and phishing against vulnerable populations. The post dates from May 2026, so it is not a fresh alert, but it remains relevant to assess structural exposure of Bolivian state programmes.Leak● 90
Filtración de datos de la Alcaldía de Guadalajara de Buga y su hospitalAn actor advertising on DarkNetArmy claims to hold databases from the municipal government of Guadalajara de Buga (Valle del Cauca, Colombia) and the Divino Niño hospital. The dump reportedly contains citizen and patient records, exposing sensitive personal and health data held by a public entity and a care provider. Verify authenticity urgently, notify both institutions and watch for fraud, extortion or phishing abuse of the data.Leak● 38
Base de datos de 200.000 clientes de ekiba.de a la ventaA roughly 200,000-record database of the German company ekiba.de, containing phone numbers and emails, is being sold on the BreachForums marketplace. The scale is modest and limited to contact data, but paired phone and email enables SMS/voice phishing and smishing against customers. A real but low-impact commercial leak rather than a critical-infrastructure or access event.Leak● 40
Combolist VIP de 1,3 millones de credenciales URL:login:passwordA contributor released about 1.3 million URL:login:password entries taken from a private VIP section, dated 10/17/2026. The volume is moderate and the content is generic credential material rather than a targeted breach of a specific organization. Still, matched URL:login pairs can seed account takeover attempts, so watch any corporate domains that appear.Leak● 55
Filtración de 75 millones de credenciales URL:login:passwordA private, freshly posted ULP dump contains roughly 75 million URL:login:password stealer-log entries dated 18/10/2026. Because stealer logs pair valid credentials with the exact site they unlock, they fuel credential stuffing and initial access against both consumer and corporate accounts. Defenders should assume exposed credentials will be replayed and prioritize password-reset and MFA checks on any matched domains.Leak● 38
Filtración de base de datos de Telekom Serbia con más de 650.000 registrosForum users are sharing a 650,000+ line database attributed to Telekom Serbia, a national telecom operator. If genuine it exposes subscriber and account data of a critical-communications provider. The post dates to March 2026, so it is not a fresh alert, but it remains useful for historical exposure and password-reuse tracking.