BRIEFLeakhighP52
CAF.fr database leak with 31 million records
CAF.fr (France)
Detected31 October 2026 · 10:24 UTC
A DarkForums 'Databases' thread offers a 31.10M-record dataset labeled CAF.FR, the French family-benefits agency. Large-scale exposure of benefit recipients' data fuels phishing and social-engineering against vulnerable populations. The agency should verify the data and warn beneficiaries about fraudulent contact.
CategoryLeak
Severityhigh
Priority score52
Detected31 October 2026 · 10:24 UTC
Leak● 40
Presunta base de datos de 820 millones de usuarios de Alipay a la ventaA DarkForums thread by user Vinkeval claims to offer a full database of 820 million Alipay users, one of the largest payment platforms in China. Claims of this scale on Alipay have circulated for years and are frequently recycled or fabricated, so the sample needs validation before any conclusion about real exposure. If genuine, it would be among the largest credential and identity leaks ever seen in fintech.Leak● 46
Base de datos del Observatorio Parlamentario de Irak filtradaA DarkForums user (Zarlotor) publishes a database attributed to the Iraq Parliamentary Observatory, a legislative-monitoring body. Exposed records of parliamentary staff, contacts and monitoring work can support social engineering against legislators and interference operations. The volume and verification level are unclear, but it is a fresh government-adjacent leak worth cataloguing.Leak● 60
Presunta filtración de documentos y datos de usuarios de BinanceA DarkForums user (Raxmusen) posts what is claimed to be Binance internal documents and customer data under a 'Binance leak 2026' thread. If authentic, exposed KYC-style records of a major exchange fuel SIM-swap, account-takeover and extortion attempts against crypto users, including many in Latin America. Claims of this kind are often recycled, so verification of the sample's freshness is essential before alerting.Leak● 62
Filtración gratuita de datos de la aerolínea Plus UltraA DarkForums post offers for free a data set belonging to Plus Ultra, the Spanish airline operating routes to Venezuela and other Latin American destinations. Airline data typically includes passenger identities, itineraries and contact details, useful for phishing and travel-fraud campaigns across Spain and LatAm. The release being free maximises downstream abuse, so regional airlines and travel-sector defenders should assess quickly.Leak● 68
Base de datos de clientes del club La Reserva de Sotogrande a la ventaA DarkForums actor (Zynxeutov) advertises an 'exclusive 2026' database of La Reserva Club Sotogrande, a high-end golf and real-estate club in southern Spain, claiming data on wealthy clients. If genuine, it exposes high-net-worth individuals' contact and membership details, a prime target list for phishing, fraud and extortion. Defenders and private-banking/real-estate partners in Spain should verify exposure and warn affected clients.Leak● 42
Múltiples filtraciones en operadores de telecomunicacionesA DarkForums post bundles alleged leaks from multiple telecom operators, a critical-infrastructure sector. Telecom data exposes subscriber records and network details attractive for fraud and further intrusion; however the operators and scope are not specified in the listing. Defenders should obtain the sample to identify any regional carriers involved.