BRIEFLeaklowP45
Data leak of Trezor, Ledger and Arculus hardware wallet users
Trezor, Ledger, Arculus / ShipMonk
Detected7 November 2026 · 08:43 UTC
Actor 'Ghost_King' posted on DarkForums a 2026 database bundling records attributed to hardware-wallet vendors Trezor, Ledger and Arculus plus logistics provider ShipMonk. If genuine, it exposes customer identities, shipping addresses and order details used for targeted phishing and physical-theft risk against crypto holders. Authenticity and true scale still need verification.
CategoryLeak
Severitylow
Priority score45
Detected7 November 2026 · 08:43 UTC
LeakPriority 62
Filtración de datos de 2 millones de vehículos y usuarios de Nuevo LeónA forum user published for free a dataset of roughly 2 million combined vehicle-registration and user records attributed to Nuevo León, Mexico, on DarkForums. The dump appears to bundle names, addresses and vehicle identifiers tied to residents. Because state vehicle-registry data enables identity fraud, targeted phishing and physical-location risk, Mexican authorities and affected residents should treat these records as exposed.LeakPriority 48
Venta de datos de seguro social de la SSA de EE. UU.A seller on DarkForums claims to be offering SSN data attributed to the US Social Security Administration, a federal agency. If authentic, exposure of Social Security numbers can fuel identity theft and tax fraud at scale. The claim is unverified and scale/date are unclear, but it names a high-value government target and warrants scrutiny.LeakPriority 45
Filtración de base de datos del Instituto Politécnico Nacional (ipn.mx)User s4100n published a database titled 'ipn.mx' in the Leaks/Databases section of DarkForums, referring to the domain of Mexico's Instituto Politécnico Nacional, a public national education institution. The thread dates from 10 June 2026, so it is already several months old, and neither the record count nor the data fields are disclosed. Leaked academic and staff records from a public institution enable credential stuffing, phishing and account takeover affecting students and employees.LeakPriority 42
Base de datos con PII de clientes mexicanos de Cosmotienda filtradaPoster 'Jaded' shared a Freebie on BlackBones Carding Forum advertising what is described as a 2026 Mexican PII database belonging to Cosmotienda, a Mexican cosmetics retailer. The post dates from 23 August 2026 and no record count, data fields or sample are provided, so the real scale is unverified. Customer PII of Mexican consumers supports phishing, identity fraud and account takeover, and triggers data-protection obligations for the retailer.LeakPriority 40
Filtración de base de datos del Partido Baaz de Irak y SiriaA database attributed to the Iraq/Syria Socialist Ba'ath Party was offered for download on BreachForums, potentially exposing membership or personnel records of a politically sensitive organization. The post provides no clear date or record count, so its recency and scale cannot be confirmed. It is mainly relevant for regional political-risk and counter-intelligence monitoring rather than for AR-LATAM defenders.LeakPriority 48
Publican 18.000 cuentas de Coinbase filtradasA set of roughly 18,000 Coinbase accounts was published on DarkForums by user Zannokar on November 1, 2026 in the cracked-accounts section. Crypto exchange accounts are prime targets for account takeover and direct theft, and leaked credentials fuel credential-stuffing and phishing against users. The moderate size limits impact but the financial sector should watch for credential reuse.