BRIEFLeakhighP72
Database with 2 million Brazilian CPF numbers and photos for sale
Ciudadanos brasileños (2M CPF + fotos)
Detected8 November 2026 · 11:43 UTC
A listing on the BreachForums marketplace offers a dataset of roughly 2 million Brazilian CPF numbers paired with photos. The CPF is Brazil's national taxpayer identifier, used for banking, government services and identity checks, so combining it with facial images strongly enables identity theft, account takeover and KYC fraud at scale. Brazilian fraud, banking and public-sector teams should treat this as a high-risk PII exposure.
CategoryLeak
Severityhigh
Priority score72
Detected8 November 2026 · 11:43 UTC
LeakPriority 55
Filtración de base de datos de 6 GB de la empresa de telecomunicaciones ServetelBreachForums hosts a 6 GB archive titled with the name of Servetel, a communications/telephony solutions provider, indicating a leaked corporate database. Telecom datasets typically contain customer records, contact details and service data useful for phishing and account fraud. Defenders in the telecom sector should verify whether their data is included and assess exposure of customer PII.LeakPriority 90
Base de datos de licencias del Estado de México (172 GB) a la ventaA 172 GB database labeled 'LICENSES EDO MEX 2026' was posted for sale on DarkForums by user 'alina' on 8 November 2026, apparently containing State of Mexico government licensing records. Datasets of this type normally carry full names, addresses, CURP/ID numbers and license details of millions of citizens, enabling identity theft and targeted fraud. Mexican agencies and financial, telecom and health providers should treat the data as compromised and watch for downstream abuse.LeakPriority 52
Base de datos de Panamá con 87.000 registros a la ventaA marketplace thread on Cracked.st lists a Panama-focused database of 87,000 records for sale or trade. The sector and fields are not shown, but a sizable Panama dataset matters for Latin American defenders because it may contain credentials or personal data reused in further attacks. Analysts should obtain samples to confirm scope and notify affected entities.LeakPriority 62
Exposición de seguridad en la infraestructura de datos satelitales HimawariA DarkForums post advertises a database and 'security exposure' tied to Himawari satellite data infrastructure, used for weather and environmental monitoring. The record count and access details are unclear, but exposures touching satellite and geospatial pipelines are high-value because they can reveal operational systems and downstream dependencies. Space, meteorology and critical-infrastructure defenders should watch for follow-on access sales.LeakPriority 70
Base de datos del gigante farmacéutico Aurobindo a la ventaA threat actor using the alias MoonTheWolf posted on DarkForums on November 7, 2026 a large database attributed to pharmaceutical manufacturer Aurobindo (aurobindo.com). The listing does not disclose record counts or data types, but a breach of a major pharma firm can expose internal systems, employee records and business partners. Defenders should treat the claim as credible until verified and watch for credential reuse.LeakPriority 42
Base de datos de MGM Grand Hotels publicada en foroA BreachForums post offers a downloadable MGM Grand Hotels database. It appears to be a repost of previously circulating hotel-guest data rather than a fresh breach, limiting operational urgency. Still, it exposes guest records reused in phishing and account-takeover attempts against hotel customers.