BRIEFLeaklowP42
Massive leak of 20 million stolen credential lines
Detected19 September 2026 · 06:12 UTC
A forum post advertises roughly 20 million stolen URL:login:password lines originating from stealer logs. The dump is generic and not tied to a named victim, but its volume makes it valuable for credential-stuffing and password-reuse attacks across many organizations. Defenders should ingest it for exposure monitoring rather than treat it as a targeted intrusion.
CategoryLeak
Severitylow
Priority score42
Detected19 September 2026 · 06:12 UTC
Leak● 41
Base de datos CRM del concesionario francés Distinxion a la ventaA seller advertises a French dataset described as 518K CRM contacts, 291K emails and 410K phones (57 MB) attributed to the Distinxion used-car network. The volume is consistent with a full customer-relationship export rather than a scraped list, though the thread is login-walled and undated. Exposed CRM data of a dealership group supports vehicle-financing fraud, insurance impersonation and convincing phishing of buyers.Leak● 44
Base de datos de la empresa colombiana El Zarzal a la ventaA seller on an onion forum lists a database belonging to the Colombian site elzarzal.com, indicating a breach dump is being traded. The thread is login-walled so record counts and data fields are not visible, and no date is given. Even a small Latin American commercial database is useful for localised fraud and phishing against Colombian customers and staff.Leak● 52
Base de datos de la plataforma Twizzit (1,53M miembros) a la ventaA seller on an onion forum offers a dataset described as 1.53 million Twizzit members, 178K groups and 5.5K organisations across Belgium, France and the Netherlands (1.4 GB). Twizzit is used by sports clubs and associations, so the records likely tie named individuals to clubs, roles and contact details. Such a corpus enables highly targeted phishing of volunteers and club administrators and could expose minor members.Leak● 68
Filtración de documentos confidenciales del Ministerio de Defensa de Brasil sobre radaresA thread on the spear.cx forum claims to distribute confidential Brazilian Ministry of Defense material on advanced radar and space-based surveillance programs; the body is behind a login wall and the publication date is unknown. The filename-style title suggests documents rather than credentials, but scale and authenticity are unverified. If genuine, exposure of defense sensor/radar requirements would aid adversary collection against a Latin American military target.Leak● 44
Filtración de datos de tarjetas SIM de Indonesia con 126.547 registrosA thread on the pwnfrm onion forum offers an Indonesian SIM card data leak labelled with 126,547 records. Subscriber registration data of this kind typically contains national ID numbers and phone numbers, which enable SIM-swap fraud, account recovery abuse and targeted smishing. The post is login-walled and undated, so the authenticity and freshness of the dataset still need to be confirmed.Leak● 58
Base de datos de un millón de usuarios de Crypto.com ofrecida gratisA thread on the onion forum spear4h2potiyk43oilufhuq2jqbioyaizcs7xttlyw75s5ykwxpxlid advertises a free database of roughly one million Crypto.com users. Content sits behind a login wall, so only the title is verifiable, but a leak of that size would feed phishing, SIM-swap and account-takeover campaigns against exchange customers. Crypto exchange users are high-value targets because balances are directly monetisable.