BRIEFLeakhighP60
SplitVPN (NotVPN) database leak: 23.4M users
SplitVPN / NotVPN
Detected27 September 2026 · 07:17 UTC
Reposts collapsed2
A dataset claimed to be from SplitVPN (NotVPN) contains 23.4M users, 58M logs and 13.6M devices. VPN account and connection logs expose user identities, credentials and usage patterns, enabling credential stuffing and targeted attacks. It is a sizable fresh consumer-VPN leak worth monitoring even outside the LATAM government scope.
CategoryLeak
Severityhigh
Priority score60
Detected27 September 2026 · 07:17 UTC
LeakPriority 48
Base de datos de Azerbaijan Airlines (azal.az) a la ventaA seller on BreachForums is offering a database allegedly from Azerbaijan Airlines (azal.az) that includes passenger records and upcoming flight details. Airline passenger data enables targeted phishing, loyalty-account takeover, and social-engineering of travelers. The airline and regional aviation authorities should verify the breach and alert affected passengers.LeakPriority 56
Filtración de 30 millones de datos de Dukcapil de IndonesiaA user posted on DarkForums offering what is claimed to be 30 million records from Dukcapil, Indonesia's civil registration agency responsible for population and ID data. Such records include national ID, family and address details that fuel identity fraud and account takeover across financial and government services. Indonesian authorities and banks should validate the claim and watch for KYC-bypass attempts.LeakPriority 62
100 GB de datos KYC de Transak a la venta en un foroA user calling themselves oxrock posted on DarkForums claiming to leak 100 GB of KYC documents belonging to Transak, a global crypto on/off-ramp provider. KYC files typically contain identity documents, selfies and proof of address, creating high identity-theft and account-takeover risk for users. Financial and crypto platforms should monitor for downstream misuse of the exposed identities.LeakPriority 85
Filtración de base de datos de la Alcaldía de Bolívar, ColombiaAn actor posted on DarkForums a database allegedly belonging to the Alcaldía Municipal de Bolívar, a municipal government in Valle del Cauca, Colombia, exposing citizen and administrative records. Leaks of public entities like this enable identity fraud, targeted phishing against public officials, and further intrusions. Colombian public bodies and the regional CERT should verify the scope immediately.LeakPriority 50
Venta de base de datos de la plataforma española Megacursos (100K)Seller Richard2002 is offering a database advertised as ~100,000 records from megacursos.com, a Spanish online-courses platform, on the DarkForums marketplace. The listing indicates a real organization's user data is being monetized, exposing potentially names, emails and credentials of students and customers. Such data fuels credential stuffing and targeted phishing against Spanish-speaking users.LeakPriority 52
Venta de base de datos de la web húngara kutyubazar.hu (1M registros)Seller Richard2002 is offering a roughly 1-million-record database from the Hungarian pet marketplace kutyubazar.hu on DarkForums. Full-site scrapes like this typically include emails, hashed passwords and phone numbers, enabling credential stuffing and targeted phishing. The listing appeared within days of this alert, so the data is likely fresh and usable.