BRIEFLeakhighP66
Robinhood database of 14.5 million users for sale
Robinhood
Detected11 October 2026 · 01:21 UTC
Reposts collapsed2
A DarkForums post advertises a leaked database of 14.5 million Robinhood users hosted on US servers. If genuine, it would expose large volumes of retail brokerage customers' personal and financial data for fraud and account-takeover campaigns. The claim must be verified against known breaches, but its scale warrants urgent attention.
CategoryLeak
Severityhigh
Priority score66
Detected11 October 2026 · 01:21 UTC
Leak● 47
Filtración de archivo .env con credenciales de SATTNORDA BreachForums leak post dated October 11 exposes an .env configuration file allegedly belonging to SATTNORD, which typically contains API keys, database credentials and tokens. Such secrets can grant direct access to backend systems and third-party services. The named organization should rotate all keys and secrets referenced in the file immediately.Leak● 24
Volcado SQL de la empresa brasileña topsay.com.brA SQL dump of the Brazilian company topsay.com.br was posted on DarkForums, dated June 2023. While the data relates to a Latin American firm, the post is over three years old and likely already circulated, so it is not a fresh alert. Worth noting for exposure history only, not for immediate response.Leak● 56
Filtración de base de datos del CREFRS de Rio Grande do SulA database belonging to CREFRS, Brazil's Rio Grande do Sul Regional Council of Physical Education, is being offered in the DarkForums leak section. The dump likely exposes registrants' names, documents and contact data, enabling identity fraud and targeted phishing against a regulated Brazilian professional body. Affected parties should confirm scope and warn members.Leak● 45
Filtración de datos de terceros de una empresa turca de ciberinteligenciaA forum user is leaking third-party data reportedly tied to a Turkish cyber threat intelligence company, posted only minutes ago. Even partial exposure of a CTI vendor's internal or client data can reveal investigative sources and partner relationships. Analysts should monitor for further dumps naming affected clients.Leak● 50
Filtración de base de datos de empleados del aeropuerto de RiadA database of Riyadh Airport employee records is being offered for download on BreachForums, exposing staff names and contact data from a government-adjacent transport operator. Though outside Latin America, it matters for aviation-sector defenders since the leaked employee details enable targeted phishing and credential attacks.Leak● 40
Base de datos de Telegram de 200 millones de líneas a la ventaAn actor is advertising a Telegram database of more than 200 million lines, likely phone and user records, on a cybercrime forum. Data of this size fuels large-scale smishing, account takeover and impersonation campaigns. It is global in scope and the post is several weeks old, so treat it as background rather than a fresh alert.