BRIEFLeakhighP55
SpainDB leak exposes data of 300,000 Spanish individuals
SpainDB (300K personas)
Detected15 November 2026 · 20:13 UTC
On 15 November 2026 the user 'syx171' published 'SpainDB', a database covering roughly 300,000 Spanish individuals, in the DarkForums leak section. Population data of this kind typically fuels phishing, identity fraud and credential-stuffing against banks and online services. Spanish organizations should check whether their users appear in the dataset and warn affected customers.
CategoryLeak
Severityhigh
Priority score55
Detected15 November 2026 · 20:13 UTC
LeakPriority 90
Filtración de 400 GB de datos del ayuntamiento de Cancún (cancun.gob.mx)The user 'arcepah' published a 400 GB database allegedly belonging to the Cancún municipal government (cancun.gob.mx) on DarkForums on 15 November 2026. Municipal data can include citizen records, internal documents and credentials, enabling identity fraud and follow-on intrusion into government systems. Defenders should verify the leak against exposed assets and watch for credential reuse.LeakPriority 50
Filtración de 6,9 millones de credenciales URL:LOG:PASSActor cloudmarket_pro published a 6.9 million line URL:LOG:PASS dataset labelled private and UHQ on DarkForums in November 2026, and the same dump is being reshared on other forums. Each line maps a login URL, username and plaintext password, which is directly usable for credential stuffing against corporate VPNs, webmail and SaaS portals. Because the scope is not segmented by organization, defenders must assume employees of any sector may be included.LeakPriority 56
Filtración de la base de datos de la Universidad de MadridOn 15 November 2026 the actor syx171 published a 'DATABASE Universidad Madrid' thread on DarkForums, the same account that posted a Spanish hospital dump minutes earlier. The dump likely contains academic and staff accounts plus personal data of students, which enables phishing and credential stuffing against university services. The duplicate thread posted two minutes later suggests active promotion of the same dataset.LeakPriority 63
Filtración de base de datos de un hospital de EspañaThe user 'syx171' posted on DarkForums on 15 November 2026 a database allegedly belonging to a Spanish hospital. Healthcare records are highly sensitive and valuable for fraud and extortion, and a breach can expose patient and staff data. Spanish health-sector defenders should confirm the scope and monitor for downstream misuse.LeakPriority 55
Colección de datos SCADA de EE. UU. publicada en BreachForumsA data collection labeled 'BhriguOne Scada US' was posted on BreachForums by user waykurap on 15 November 2026. If authentic, bundling SCADA/ICS-related data for US industrial targets raises risks for operational technology operators and vendors. Though outside the AR-LATAM focus, it is a fresh, time-sensitive critical-infrastructure leak worth tracking.LeakPriority 62
Filtración de declaraciones patrimoniales de funcionarios de MéxicoA database of 'declaraciones patrimoniales' (asset declarations) of Mexican public officials was leaked on DarkForums by user SoftVoid. Such records expose officials' income, properties and family assets, enabling targeting, extortion and corruption profiling. Mexican government bodies should confirm the source and warn affected officials.