BRIEFLeaklowP40
Reposted leak of 3.8 million Zain Telecom Iraq records
Zain Telecom (Irak)
Detected20 September 2026 · 00:37 UTC
A CSV of roughly 3.8 million records allegedly from Iraqi telecom Zain is being re-shared. Telecom is critical infrastructure and such data enables SIM-related fraud and targeted phishing, but the item is an out-of-region repost with no fresh date, so urgency is low for Latin America. Track it mainly as context rather than a new alert.
CategoryLeak
Severitylow
Priority score40
Detected20 September 2026 · 00:37 UTC
Leak● 62
Base de datos del servicio de bomberos francés SDIS (7K registros) publicada por AplaGroupA threat actor using the handle AplaGroup is advertising a database allegedly belonging to a French fire and rescue service (SDIS), roughly 7,000 records, on the pwnfrm onion forum. Although small in volume, the victim is an emergency-services organization, so exposed data likely includes personnel, contact and operational details useful for spear-phishing or physical targeting. The post date is not visible in the recovered thread, so recency should be confirmed before escalating.Leak● 48
Datos y permisos de base de datos de Shanghai IMPACT Therapeutics a la ventaA BreachForums thread advertises 'Database Permissions and Full-Set Data' belonging to Shanghai IMPACT Therapeutics (HKEX: 07630), a clinical-stage biopharma company. It appears to offer both live database access and a full copy of the dataset, implying a real organizational compromise rather than a combolist. Sensitive research and clinical data could be at risk, though it is outside the AR-LATAM focus and the date/scale are unverified.Leak● 76
Base de datos del Ejército Argentino filtrada por EsqueleSquadThe actor EsqueleSquad published a database allegedly belonging to the Argentine Army (Ejército Argentino) in the leak section of the Spear Leaks forum, presented as a downloadable archive. Although the thread dates from late July 2026 and is therefore a few months old, it exposes military personnel or institutional data and remains a valid exposure for credential stuffing and targeting of defense staff. Any records tied to .mil.ar identities should be treated as already compromised and monitored for reuse.Leak● 86
Base de datos de Diners Club Ecuador comprometida y a la ventaUser 'pheisito' posted today (04 Nov 2026) on BreachForums a thread titled 'DINERS ECUADOR HACKED', indicating a breach of Diners Club Ecuador, a card issuer and regulated financial institution. Cardholder and customer data of a bank-like entity is at stake, enabling payment fraud, account takeover and downstream identity theft. It is fresh and directly relevant to Ecuador's financial sector.Leak● 40
Presunta filtración de un millón de registros de Crypto.com reeditada en foroA Niflheim forum thread re-advertises a '1 Million Database' attributed to crypto exchange Crypto.com. The thread is an older post being bumped with fresh replies rather than a new release, and the underlying data has circulated in prior waves. It is relevant for tracking crypto-sector credential exposure, but it is not a fresh alert and the authenticity of the records is unconfirmed.Leak● 48
Base de datos de 100.000 usuarios de un banco de EE. UU. ofrecida como filtraciónA thread on the Spear Leaks forum advertises a 'FRESH' file containing full information on 100,000 US bank users. The body is behind a login wall, so the institution is unnamed and the sample cannot be validated from the title alone. Financial KYC data at that scale would support account takeover and synthetic-identity fraud, but without the bank's identity or a verifiable sample this is a low-confidence claim.