BRIEFLeakhighP40
3 GB of stealer logs from 2026-09-21 published
Detected22 September 2026 · 04:01 UTC
A 3 GB set of freshly captured stealer logs (dated 21 Sep 2026) bundling credentials, cookies and session data has been published. Stolen logs like these are directly usable for account takeover and initial access across many organizations. Their freshness makes them operationally dangerous right now.
CategoryLeak
Severityhigh
Priority score40
Detected22 September 2026 · 04:01 UTC
LeakPriority 46
Filtración de datos de 140.000 usuarios de TourPay.appA BreachForums thread advertises a data breach affecting roughly 140,000 users of the travel payment service TourPay.app. The dataset reportedly covers customer accounts, which are valuable for payment fraud and credential stuffing against travel-sector partners. The post shows a multi-page thread with no clear recent date, so it should be triaged as relevant but not a fresh alert.LeakPriority 74
Base de datos de licencias de la Ciudad de México a la ventaA seller using the handle 'alina' posted on DarkForums a database advertised as Mexico City licenses, published today. Licensing records typically include full names, addresses, ID or tax numbers and contact data of residents and businesses, making them directly usable for identity fraud and targeting. Defenders in Mexican municipal government and licensing bodies should treat this as a probable exposure of citizen PII.LeakPriority 62
Base de datos de Salesianos Zaragoza a la venta en BreachForumsAn actor using the handle AndreGretry published a database belonging to Salesianos Zaragoza, a Catholic educational institution in Spain, on BreachForums (bf.st) on 6 November 2026. The exact record count is not visible in the snippet, but the release is framed as a full organizational database, so it likely contains personal data of students, families and staff. Spanish educational institutions hold minors' records, making this a sensitive privacy and regulatory exposure under GDPR/LOPDGDD.LeakPriority 55
Base de datos de un banco filtrada y compartida en el foro DarkNetArmyA forum user (SUB-ZER0) published a freebie labeled 'DATABASE OF A BANK' in the DarkNetArmy Premium Members section this week. The posting does not disclose the victim bank or its country, but bank customer databases carry high fraud and account-takeover risk, so the material should be validated. If a Latin American institution is behind it, records could include PII and account data usable for social engineering.LeakPriority 40
Publican 16,2 millones de credenciales robadas de todo el mundoA VIP-section post on DarkForums (mirrored on Spear) advertises a 16.2 million-line URL:login:password corpus dated 06/11/2026, assembled from global stealer logs. No victim organization is named, which limits direct attribution. The volume still supports large-scale credential stuffing against corporate VPNs, webmail and e-commerce.LeakPriority 47
Filtración de base de datos de una aseguradora india con 1,59 millones de registrosA BreachForums post under the 'OGNIGGERS' tag offers a downloadable India insurance database totaling 1,590,798 rows. The leak exposes policyholder and customer records for an insurance sector victim, useful for fraud and identity theft. It is outside the AR-LATAM focus but represents a sizeable freshly referenced dataset worth checking against known breaches.