BRIEFLeakhighP48
Leak of 15+ million stolen credential logs
Secretline.top / StarLinkClouds
Detected16 September 2026 · 06:12 UTC
A 15-million-line credential dump (URL:login:password) linked to Secretline.top and StarLinkClouds stealer logs is circulating across several forums. Volumes this large fuel credential stuffing and account takeover against corporate VPNs, email and cloud services. It is worth screening for reused government, banking or telecom credentials.
CategoryLeak
Severityhigh
Priority score48
Detected16 September 2026 · 06:12 UTC
Leak● 42
Base de datos de LinkedIn de Austria, Liechtenstein y SuizaA DarkForums post offers LinkedIn profile data segmented for Austria, Liechtenstein and Switzerland. Such collections are almost always derived from large-scale scraping rather than a new breach, but they still enable targeted phishing of named professionals. Regional firms and executives should assume their public profile data is in circulation.Leak● 52
Base de datos de AT&T con 70 millones de registros a la ventaA DarkForums thread posted 31 Oct 2026 claims an AT&T database of 70 million records. Large AT&T customer collections have circulated since the 2024 breach, so this is most likely recycled data rather than a new intrusion. It remains useful for spotting credential reuse and for confirming which customers are already exposed.Leak● 55
Filtración de 1,5 millones de registros de estudiantes del ICAI de IndiaA post on a BreachForums onion site advertises a 1.5 million record leak from boslive.icai.org, the student portal of India's Institute of Chartered Accountants. The dataset likely contains student names, registration numbers and contact details useful for phishing and identity fraud. Exam candidates and accounting students are the primary exposed population.Leak● 66
Reclamo de filtración de 820 millones de usuarios de AlipayA DarkForums thread claims a full database of 820 million Alipay users is being offered, with content hidden behind a login wall. The scale is implausible as a single fresh breach and may be repackaged or fabricated data from older Chinese dumps. It should be tracked as an unverified claim affecting a major payments platform rather than a confirmed incident.Leak● 72
Base de datos filtrada de QiCard, el sistema de pagos de IrakA threat actor posted on DarkForums on 31 Oct 2026 a database attributed to QiCard, the national debit-card and payment switch used by Iraqi state banks and millions of citizens. If authentic, the records expose identifiers and financial data tied to critical national payment infrastructure. Iraqi banking and payment providers should treat the claim as credible until it is disproven.Leak● 55
Presunta base de datos de Coinbase ofrecida en DarkForumsA DarkForums account (datamunchers) that advertises bulk data posted a thread titled 'COINBASE' in the Leaks/Databases section, implying a Coinbase customer database is for sale. Coinbase is a major global crypto exchange, so any customer or KYC data exposure carries serious fraud and regulatory risk. The post provides no scale, sample, or proof, so it must be treated as unverified until corroborated.