BRIEFLeakhighP52
Health data leak of 1.8M citizens in Shandong, China
Shandong province health authority
Detected16 September 2026 · 09:12 UTC
A database with sensitive detail on roughly 1.8 million residents of Shandong province, China, including health codes and national ID numbers, is being shared in CSV form. This is government-linked citizen health data, enabling identity theft and targeted fraud. Defenders tracking regional data-broker activity should note the reuse potential of such identifiers.
CategoryLeak
Severityhigh
Priority score52
Detected16 September 2026 · 09:12 UTC
Leak● 56
Filtración de la base de datos de la farmacéutica AurobindoA database attributed to Aurobindo Pharma, a major generics manufacturer, was posted on DarkForums on 30 October 2026 by user Lyklekor. Leaks of this type typically expose corporate emails, employee records and partner contacts that enable BEC and supply-chain phishing in the pharmaceutical sector. Sample validation is recommended before public attribution.Leak● 65
Filtración de datos de usuarios e informes de Binance 2026A DarkForums thread posted on 31 October 2026 by user Radkekar advertises leaked Binance internal documents and user data from 2026. No record count or sample is provided, so the claim is unverified, but any genuine dataset from a top-tier exchange fuels account takeover, phishing and extortion against traders. Exposed corporate documents can also reveal internal infrastructure and partner details.Leak● 58
Base de datos de 10 millones de Gemini a la ventaA DarkForums thread claims to offer a 10-million-record database tied to gemini.com, with content hidden behind a forum login and no sample verification. If genuine, it would expose emails, KYC-adjacent details and account data from a regulated crypto exchange, a prime target for account takeover and extortion. Treat the claim as unconfirmed until samples are validated.Leak● 45
Volcado de 31 GB de registros stealer de DAISYCLOUDA 31.10 GB stealer-log archive labelled DAISYCLOUD and dated January 2026 was published on DarkForums by user Solvizor. Logs of this size typically aggregate hundreds of thousands of infected machines, exposing browser credentials, cookies and session tokens for corporate and personal services. It is a mass-triage source rather than a single-victim incident.Leak● 40
Filtración de 783.589 registros de la tienda acbuy.comA 783,589-record database attributed to acbuy.com, a cross-border shopping-agent platform, was posted on DarkForums by user 0xcode. The records appear to be customer account data that can enable credential stuffing, phishing and takeover of parcel-forwarding accounts. Volume is moderate but the dataset is usable for fraud against overseas buyers.Leak● 55
Filtración de la base de datos de CIIDET-TECNM (México)CIIDET, a technical-education institute under Mexico's TecNM, has a full database backup circulating on DarkForums via 'Lucr0$ Crew'. The data dates from 2024, so it is stale, but it may still hold staff and student PII usable for phishing and credential stuffing. Defenders should confirm scope and notify affected users.