BRIEFLeakhighP68
GIIS/Global Schools breach exposes 33k passports and official IDs
Global Schools Foundation (GSF) / GIIS
Detected3 September 2026 · 01:03 UTC
A darkweb post in September 2026 offers or announces a fresh leak from GIIS/Global Schools/GSF, citing roughly 33,000 student/family passports and around 30,000 government-issued identifiers. The exposure of identity documents, especially those of minors, is highly sensitive and could facilitate fraud, identity theft, or targeted phishing; defenders should validate the claim and assess any regional impact.
CategoryLeak
Severityhigh
Priority score68
Detected3 September 2026 · 01:03 UTC
Leak● 38
Base de datos de 200.000 clientes de ekiba.de a la ventaA roughly 200,000-record database of the German company ekiba.de, containing phone numbers and emails, is being sold on the BreachForums marketplace. The scale is modest and limited to contact data, but paired phone and email enables SMS/voice phishing and smishing against customers. A real but low-impact commercial leak rather than a critical-infrastructure or access event.Leak● 40
Combolist VIP de 1,3 millones de credenciales URL:login:passwordA contributor released about 1.3 million URL:login:password entries taken from a private VIP section, dated 10/17/2026. The volume is moderate and the content is generic credential material rather than a targeted breach of a specific organization. Still, matched URL:login pairs can seed account takeover attempts, so watch any corporate domains that appear.Leak● 55
Filtración de 75 millones de credenciales URL:login:passwordA private, freshly posted ULP dump contains roughly 75 million URL:login:password stealer-log entries dated 18/10/2026. Because stealer logs pair valid credentials with the exact site they unlock, they fuel credential stuffing and initial access against both consumer and corporate accounts. Defenders should assume exposed credentials will be replayed and prioritize password-reset and MFA checks on any matched domains.Leak● 38
Filtración de base de datos de Telekom Serbia con más de 650.000 registrosForum users are sharing a 650,000+ line database attributed to Telekom Serbia, a national telecom operator. If genuine it exposes subscriber and account data of a critical-communications provider. The post dates to March 2026, so it is not a fresh alert, but it remains useful for historical exposure and password-reuse tracking.Leak● 66
Base de datos de la utility ginebrina SIG a la ventaA seller in the BreachForums marketplace is offering a database attributed to Services Industriels de Genève (SIG), the Swiss utility that supplies water, electricity, gas and telecom to the Geneva canton. Record count and exposed fields are not disclosed, but any dump of customer or staff data enables targeted phishing and credential abuse against a critical-infrastructure operator. Treat it as an unconfirmed but credible lead for energy/water-sector defenders.Leak● 28
Repost: 3 millones de registros de débito de EE. UU. a la ventaA 3M-record US debit-leads dataset was reposted on BreachForums, dated 31 May 2026. It is a repost of already-circulated financial leads rather than a new breach, limiting its freshness. Still relevant for fraud-monitoring teams tracking exposed cardholder/debit data, but not a new alert.