BRIEFLeakcriticalP92
Full database leak of Mexico's Cultura.gob.mx
Secretaría de Cultura de México (cultura.gob.mx)
Detected4 November 2026 · 20:24 UTC
Actor 'Frouzenx' posted on DarkForums what is claimed to be the full database of Cultura.gob.mx, the Mexican Ministry of Culture's portal. A complete dump of a .gob.mx site risks exposing staff credentials, internal contacts and program data useful for follow-on intrusion. Defenders should verify authenticity and hunt for reused passwords.
CategoryLeak
Severitycritical
Priority score92
Detected4 November 2026 · 20:24 UTC
Leak● 42
Filtración de 200.000 registros del portal de GuanajuatoA DarkForums listing advertises a 200K-record database from guanajuato.gob.mx, the Mexican state government portal. The thread is closed as removed content and carries no visible date, so freshness cannot be established and the data may already be circulating for some time. It remains relevant as part of a cluster of Mexican state-portal leaks alongside Durango and Sonora.Leak● 45
Base de datos completa del portal de Sonora expuesta en DarkForumsA DarkForums thread by Frouzenx advertises a full database from sonora.gob.mx, the Mexican state government portal, without a verifiable record count. The listing is closed as removed content and the exact posting date is unclear, making freshness uncertain. It still indicates continued targeting of Mexican state portals and should be correlated with the Durango and Guanajuato postings.Leak● 54
Filtración de 200.000 registros del estado mexicano de DurangoDarkForums user DN07 listed a 200K-record database attributed to the Durango state government on 15 October 2026, following similar postings for other Mexican states. The thread is now closed as removed content, so the sample can no longer be verified publicly. State-level citizen data is frequently reused for extortion, phishing and credential stuffing against government portals.Leak● 70
Base de datos completa de Paraguay ofrecida en DarkForumsDarkForums user qillnihhers posted a thread titled FULL DATABASE PARAGUAY on 29 October, advertising what appears to be a country-level dataset rather than a single company breach. The thread is already closed with content removed, which limits verification but also suggests takedown pressure. If genuine, national-scale citizen data would enable mass identity fraud and targeted attacks on Paraguayan public services.Leak● 76
Filtración de 31 millones de registros de la CAF francesaDarkForums user Qelsusek posted a 31.1 million-record dataset labelled CAF.FR 2026, referring to France's family benefits agency, one of the largest social-security databases in Europe. The scale implies national coverage of beneficiaries and would be highly valuable for social engineering and benefit fraud. Defenders outside the region should treat it as a benchmark of how large public-sector data is being monetised.
Leak● 90
Filtración de 90.000 registros del Gobierno de TucumánA DarkForums actor using the handle Frouzenx is advertising a 90,000-record database allegedly extracted from the Argentine provincial government portal tucuman.gob.ar. If authentic, it would expose citizen and possibly staff data tied to a .gob.ar domain, opening the door to phishing, identity fraud and credential reuse against provincial services. The thread is marked closed/removed content, so validating the sample and confirming record types should be the first step.