BRIEFLeakhighP76
Peru SUNAT tax registry (RUC) database leaked, 18M+ records
SUNAT (Superintendencia Nacional de Aduanas y de Administración Tributaria, Perú)
Detected8 November 2026 · 19:43 UTC
A BreachForums posting advertises a leaked database of Peru's SUNAT RUC taxpayer and business registry, reportedly 18M+ records. SUNAT is the national tax and customs authority, so the data links companies, taxpayers and legal representatives to taxpayer identifiers, enabling fraud and targeted impersonation. The 'II' label suggests a follow-up dataset; authenticity should be verified and exposure monitored.
CategoryLeak
Severityhigh
Priority score76
Detected8 November 2026 · 19:43 UTC
LeakPriority 42
Base de datos de la colombiana Mueble Jamar a la ventaA BreachForums 'Leaks Market' thread advertises a database belonging to Mueble Jamar, a Colombian furniture retailer, for sale. The posting is thin on details, but a customer or operational database of a real LatAm company can enable phishing, order fraud and account takeover against customers. Worth tracking for confirmation of scope and record count.LeakPriority 46
Filtración de 396.000 credenciales de correo de usuarios en EspañaA large email:password combolist labelled for Spain with over 396,000 entries was posted as fresh (8-11-2026) across BreachForums, DarkForums and LeakForum. It targets Spanish-speaking users broadly rather than a single organization. Defenders in Spain should assume credential-reuse and phishing exposure for affected accounts.LeakPriority 72
Filtración de datos KYC de usuarios de TransakA threat actor on the DarkNetArmy forum is distributing KYC data of users of Transak, a global crypto fiat on-ramp, including identity documents and selfies. Such records enable identity theft, account takeover and regulatory exposure for the platform and its customers. Organizations in fintech and crypto should treat these identities as compromised.LeakPriority 40
Filtración de datos internos de la telco indonesia TelkomAn actor on DarkForums posted 228 records described as corporate accounts plus internal access data from Indonesian telecom Telkom (telkom.co.id), dated 2026. The volume is small, but internal-access credentials to a national operator could enable deeper intrusion if still valid. Indonesian telecom defenders should verify whether these accounts remain active.LeakPriority 68
Base de datos de clientes de Jazztel (Orange) a la ventaA seller on BreachForums is offering a database of over one million records allegedly tied to Jazztel, the Spanish telecom operator owned by Orange. If genuine, it exposes customer emails and credentials that enable credential stuffing and account takeover against a major Spanish telecom. Defenders should treat Jazztel customer accounts as potentially compromised.LeakPriority 56
Base de datos de más de 2 millones de registros de airship.co.uk a la ventaA seller in the BreachForums Leaks Marketplace is advertising a database of more than 2 million records attributed to UK company airship.co.uk. The listing does not fully detail the fields, but a dataset of this size typically contains customer and corporate contact data valuable for phishing and credential stuffing. Organizations whose users or partners relate to the firm should confirm whether their accounts appear.