Alleged massive data breach of Turkish GSM operators

Operadores GSM de Turquía

Detected25 October 2026 · 10:50 UTC

Why it matters

A BreachForums actor (Straz) claims to have published what is described as Turkey's largest GSM data breach, allegedly exposing subscriber records from national mobile carriers. Telecom subscriber data fuels SIM-swap, phishing and surveillance against a critical-infrastructure sector. Verify the scale and watch for downstream abuse.

MetadataRECORD

CategoryLeak

Severityhigh

Priority score62

Detected25 October 2026 · 10:50 UTC

Related items6

Leak● 58

Base de datos de la cadena minorista Family Farm and Home filtradaA BreachForums thread offers a freely downloadable database allegedly belonging to Family Farm and Home, a US farm-and-home retail chain. If authentic, it likely exposes customer and some employee records that can drive credential stuffing, phishing and account takeover. Because it is posted as a public download, exposure spreads quickly and defenders should validate the contents against their own systems.

11m

Leak● 35

Base de datos de Edmunds filtrada y disponible para descargaA BreachForums thread offers a downloadable dump of the Edmunds automotive marketplace database. If authentic, it exposes customer and business records of a large US consumer platform, useful for credential stuffing and fraud. Recency and authenticity are unconfirmed, so treat it as a lower-priority verification lead.

Leak● 24

Filtración de 1,6 GB de logs de stealer recientes (20-10-2026)A 1.6 GB batch of infostealer logs dated 2026-10-20 is being shared on Blackhat Pakistan. The material is recent and could contain corporate session cookies, saved passwords and browser data from many users, but no specific victim organization is identified. Value depends on internal matching against monitored credentials and domains; on its own it is generic and not an AR-LATAM critical-infrastructure event.

Leak● 30

Filtración de 54,7 millones de credenciales URL:LOG:PASSA 54.7M-line URL:LOG:PASS credential set has been posted as a private 'UHQ' dump, far larger than typical combolists and likely spanning many unrelated services. While it is not tied to a single named organization, its scale makes it a credential-stuffing and account-takeover risk worth cross-referencing against monitored domains. Origin and freshness are unconfirmed, so treat as background intel rather than a fresh alert.

Leak● 44

Base de datos RFFM ES publicada en foro de ransomwareA thread titled 'DATABASE RANSOM RFFM ES' on an onion ransom/leak forum claims a dumped database from a Spanish entity, likely a regional football federation, behind a login wall. If confirmed, it would expose member, licensing and affiliate data of a Spanish sports organization, useful for phishing its clubs and staff. Scope and date are unverified; confirm the victim, record count and whether extortion is ongoing before escalating.

Leak● 66

Filtración de datos del Instituto de Seguridad Social de PaulistaA database belonging to the municipal social security institute of Paulista (Pernambuco, Brazil) has been posted for public download on BreachForums. Such entities hold beneficiary, payroll and identity records of municipal public servants, which are directly usable for fraud, social engineering against staff and lateral targeting of local government systems. Defenders in Brazilian municipal administration should verify the exposure, scope of records and reset any credentials present.