BRIEFLeakhighP65
18 million credentials (URL:log:pass) posted on hacking forum
Detected15 July 2026 · 05:40 UTC
A database containing 18.04 million credentials in URL:log:pass format has been published on a Turkish hacking forum. The credentials come from multiple websites and online services, putting user accounts at risk of compromise. Defenders should search for these credentials in their systems and force password changes.
CategoryLeak
Severityhigh
Priority score65
Detected15 July 2026 · 05:40 UTC
Leak● 42
Filtración de 129.000 registros personales de Quebec, CanadáA threat actor posted a fresh dump of roughly 129,000 personal records of Quebec, Canada residents for download. It falls outside the AR-LATAM focus and the scale is modest, but the recent dump can fuel identity fraud and credential-based attacks. Worth a brief watch in case regional entities appear in the same dataset.
Leak● 70
Base de datos de la venezolana Intech (oil & gas, energía) filtradaA database belonging to Intech (intech-ie.net), a Venezuelan firm serving oil & gas, petrochemical, food, pharma and power sectors, is being offered on DarkForums. Leaked industrial-sector data can expose supplier contacts, system details and corporate credentials useful for spear-phishing or intrusion against regional critical infrastructure. Defenders in Venezuelan energy and industrial sectors should treat this as a likely precursor to targeted attacks.Leak● 52
Base de datos de California Tax Data publicada en foroA forum thread advertises a database from californiataxdata.com, a US tax-preparation service, with a record count visible in the mirrored title. Tax-related datasets carry SSNs, addresses and financial identifiers that fuel identity fraud and tax-refund scams. It is not a government body, but firms holding taxpayer data are high-value and worth validation and client notification.Leak● 90
Filtración de la base de datos completa de cyta.com.ar con SQLiAn actor is publishing the full database of cyta.com.ar, an Argentine ISP/telecom provider, together with a working SQL injection on the site. The dump likely contains customer records and credentials, and the live SQLi means the exposure is ongoing rather than historical. Argentine telecom operators are tier-1 critical infrastructure, so this warrants immediate notification, WAF blocking and credential resets.Leak● 58
Filtración de datos de la aerolínea Plus Ultra en España y LatinoaméricaA free release claims a roughly 103k-record dataset belonging to Plus Ultra, the Spanish carrier operating routes to Venezuela and across Latin America. Airline data typically includes passenger PII, contact details and booking data useful for fraud and targeted phishing. Despite being a non-government entity, its cross-border LatAm operations make it relevant for regional monitoring.Leak● 54
Venta de 200 GB de datos privados con 61 GB de documentos confidencialesA seller on DarkForums is advertising roughly 200GB of private data, of which 61GB are described as confidential documents, without naming the victim. The volume and document-heavy nature suggest an internal file-share or archive from an enterprise or institutional network rather than a simple credential dump. Defenders should track the thread to see if samples later identify a Latin American or government entity.