BRIEFLeakhighP45
Leaked AT&T data sample resurfaces on forum
AT&T
Detected30 October 2026 · 22:24 UTC
Actor Ulzsatul posted a stolen sample attributed to AT&T, the largest US telecom, on DarkForums today. The underlying AT&T breach is well known and largely stale, so this is recycled rather than a new intrusion. Stolen customer records still fuel SIM-swap, phishing and account-takeover attacks against US subscribers.
CategoryLeak
Severityhigh
Priority score45
Detected30 October 2026 · 22:24 UTC
Leak● 50
Filtración de la base de datos de RENIEC de Perú (31M, 2023)A DarkForums thread offers the RENIEC national citizen database of Peru, claiming 31 million records with data from 2023. RENIEC manages national identity documents, so such a leak would expose national ID numbers and personal details of most Peruvian adults. Although the data appears to date from 2023 and is therefore not a fresh breach, its recirculation still raises identity-fraud and account-takeover risk for defenders.Leak● 42
Base de datos de la Federación Francesa de Rugby expuestaActor Lyklekor published a database associated with the French Rugby Federation (ffr.fr) on DarkForums today. While FFR is a sports body rather than critical infrastructure, leaked records expose members, players and staff to phishing and identity fraud. It signals another French organisation being openly targeted.Leak● 48
Publican 20 GB de DNI, pasaportes y documentación robadaActor Asarxuvek posted roughly 20 GB of stolen identity documents, including national IDs (DNI), passports and other personal paperwork, on DarkForums today. No single organisation is named, but the volume of identifiers is high and directly enables identity theft, account fraud and social engineering. Organisations in Spanish-speaking countries that use DNI should treat this as a real exposure risk.Leak● 60
Base de datos de la operadora francesa SFR publicada en foroThreat actor SUB-ZER0 posted a database belonging to SFR, one of France's largest telecom operators, on the DarkNetArmy forum less than an hour before discovery. A telecom leak exposes subscriber and account data that enables SIM-swap, phishing and account takeover. Defenders at SFR and French telecom peers should assess exposure and watch for reused records.Leak● 44
Publicación de múltiples filtraciones de operadoras de telecomunicacionesYirkolon posted 'Multiple Telecoms Leaks' on DarkForums on 30 October 2026, bundling data attributed to several telecom operators without naming them in the visible text. Telecom data underpins SIM-swap, subscriber-tracking and account-takeover campaigns against a critical-infrastructure sector. The lack of named victims keeps confidence low, but carriers should watch for the full release to see if their subscribers are included.Leak● 62
Filtración de 500.000 registros de Kafene con SSN y datos bancariosA DarkForums seller claims a 500,000+ record breach of Kafene, a US consumer-finance/lease-to-own provider, including SSNs, banking data, credit scores and KYC documents. That combination is a full identity-theft kit and enables account takeover at partner merchants and lenders. It is a large, fresh-looking dump of a named real organization and should be validated quickly by the company and its banking partners.