BRIEFLeakhighP47
20 GB of stolen national IDs, passports and documents for sale
Detected30 October 2026 · 15:24 UTC
A DarkForums seller is offering roughly 20 GB of 'DNI's, passports and stolen documentation', a bulk identity-document trove rather than a single-victim breach. The post does not state issuing countries, but the Spanish-language term 'DNI' suggests Latin American sources among the material. Such collections enable account-opening fraud, KYC bypass and impersonation, so banks and identity-verification teams in the region should expect document-forgery attempts.
CategoryLeak
Severityhigh
Priority score47
Detected30 October 2026 · 15:24 UTC
Leak● 30
Filtración parcial de la base de datos de Cultura.comA RaidForums thread advertises a partial Cultura.com database for download, exposing customer records of the Brazilian retailer. Partial and likely old leaks still enable credential stuffing and phishing; the original breach date is unclear, so treat it as stale but relevant for fraud monitoring of Brazilian e-commerce customers.Leak● 52
Volcado de base de datos de usuarios de Coinbase del 27.09.2026A DarkForums thread dated 27.09.2026 by 'Shadow7596' offers a fresh Coinbase user database dump. Such dumps typically contain emails, identity data and credential material; exchange customers caught in it face phishing, account-takeover and crypto-theft risk.Leak● 60
Volcado de la base de datos de Binance (12,4 GB) en DarkForumsA DarkForums thread by 'Vortex_Forge397' advertises a 'FULL' Binance database dump sized at 12.4 GB, posted around 30 October 2026. If authentic it would expose large volumes of exchange customer and KYC data; if fabricated, it still shows sustained monetization of Binance-branded leaks that fuels phishing and account takeover.Leak● 30
Base de 1,8 millones de ciudadanos mexicanos de 2023 a la ventaThe DarkForums thread 'Mexican Citizen Database 1.8 Millions 2023' advertises a large Mexican citizen PII set, but the dataset is explicitly dated 2023 and appears reposted today rather than freshly breached. Names, addresses and identifiers of this size are valuable for identity fraud and voter- or benefit-related scams, yet prior circulation and staleness reduce its operational weight. Treat it as background context for Mexican data exposure, not as a new incident alert.Leak● 44
Filtración de 689.000 registros de PajEmploi (urssaf.fr)A DarkForums post advertises 689k records tied to PajEmploi and urssaf.fr, the French public bodies that handle payroll declarations and social contributions. Such records typically carry identifiers, employer details and salary information, which are prime material for tax fraud, business-email compromise and convincing phishing against employers and workers. The volume and public-sector nature justify tracking the dataset and comparing it with known URSSAF-related incidents.Leak● 55
Volcado de base de datos de Binance 2026 difundido en DarkForumsA DarkForums user posted a 'Binance DB dump 2026 – latest archive', claiming a fresh export of exchange data dated today. Binance has suffered multiple scrapes and resold datasets, so authenticity and freshness are unproven, but genuine records (emails, KYC fragments, balance hints) feed phishing, SIM-swap and account-takeover campaigns against crypto holders. Analysts should hash the file and compare it with previously circulating Binance samples before issuing a customer alert.