BRIEFLeakhighP66
Data leak of Universidad San Pablo de Guatemala
Universidad San Pablo de Guatemala
Detected15 November 2026 · 22:14 UTC
A threat actor using the alias Goblinciano69 published a leak of data belonging to the Universidad San Pablo de Guatemala on the DarkForums marketplace (2026). The post advertises internal records from the higher-education institution, exposing student and staff data. As a Latin American academic target, it warrants monitoring for credential and personal-data exposure.
CategoryLeak
Severityhigh
Priority score66
Detected15 November 2026 · 22:14 UTC
LeakPriority 40
Base de datos del banco yemení Kuraimi con datos KYC a la ventaA seller on DarkForums is offering a database of Kuraimi Bank, a major Yemeni financial institution, covering 8,600+ users with fullz, KYC documents, CVs and passports. Although small in volume, the inclusion of identity documents makes it sensitive for account fraud and impersonation. Relevant to financial-sector defenders tracking regional bank exposure.LeakPriority 43
Base de datos de consumidores de Emiratos Árabes Unidos a la ventaA threat actor on DarkForums is advertising a 'Comprehensive Consumer Data' dataset for the UAE, dated 2026, as a free download. The compilation appears to aggregate consumer records likely usable for fraud, phishing and account takeover across the region. No specific organization is named, so its real impact depends on verification of scale and accuracy.LeakPriority 32
Índice de búsqueda ULP con 3,62 millones de credenciales en NulledBBA 3.62 million entry URL:LOGIN:PASS dataset is offered on NulledBB as a searchable ULP index, letting buyers query stolen logins by domain. This makes targeted account takeover far easier than a raw combolist. No specific victim is named, so the risk is generic credential exposure affecting many organizations at once.LeakPriority 36
Venta privada de un volcado de 6,9 millones de credenciales URL:LOG:PASSA 6.9 million line URL:LOG:PASS set is being distributed as a private, high-quality credential dump on xReactor. It aggregates stolen logins tied to web addresses, which enables credential stuffing and account takeover across many services at once. There is no named victim organization, so impact is diffuse but broad; organizations should assume some employee credentials may be included.LeakPriority 55
Filtración de la base de datos SpainDB con 300.000 personasOn 15 November 2026 the user 'syx171' published 'SpainDB', a database covering roughly 300,000 Spanish individuals, in the DarkForums leak section. Population data of this kind typically fuels phishing, identity fraud and credential-stuffing against banks and online services. Spanish organizations should check whether their users appear in the dataset and warn affected customers.LeakPriority 90
Filtración de 400 GB de datos del ayuntamiento de Cancún (cancun.gob.mx)The user 'arcepah' published a 400 GB database allegedly belonging to the Cancún municipal government (cancun.gob.mx) on DarkForums on 15 November 2026. Municipal data can include citizen records, internal documents and credentials, enabling identity fraud and follow-on intrusion into government systems. Defenders should verify the leak against exposed assets and watch for credential reuse.