BRIEFLeakhighP74
13M-record Phone House Spain customer database for sale
Phone House España
Detected2 November 2026 · 02:24 UTC
The DarkNetArmy actor ROOT SYSTEM is selling a 13M+ record Phone House Spain database with full PII, including Spanish DNI identity numbers. The scale and official ID data make it a prime asset for identity theft, account takeover and SIM-swap fraud. Spanish retail and financial defenders should assume broad customer exposure.
CategoryLeak
Severityhigh
Priority score74
Detected2 November 2026 · 02:24 UTC
Leak● 52
Filtración masiva de 3,46 GB atribuida a Taiwán en DarkForumsA user (Haldakar) posted a 3.46 GB archive on DarkForums on November 1, 2026, labelled 'Huge TAIWAN LEAK' without naming the affected organization. If it holds government or enterprise data it could be significant for Taiwanese entities. Analysts should review the archive to identify the victim and the data types before assessing impact.Leak● 53
Volcado de 17,5M credenciales de stealer logs en DarkForumsOn October 30, 2026 a DarkForums user (Markelok) released roughly 17.5 million URL:LOG:PASS credential entries sourced from infostealer logs. Such dumps fuel account takeover, business email compromise and follow-on network intrusions. Organizations should screen for leaked corporate credentials and enforce MFA.Leak● 55
Dump de 20,3M credenciales de stealer logs en DarkForumsA user posted a private, high-quality dataset of 20.3 million URL:LOG:PASS stealer-log entries on November 2, 2026, mirrored across DarkForums and NulledBB. These are credentials harvested by infostealers, enabling account takeover and credential-stuffing against corporate and consumer services. Defenders should check their domains against the dump and force resets where matches appear.Leak● 62
Filtración de datos de empleados de Bangkok AirwaysOn November 1, 2026, a DarkForums user (Gormumen) published a leak labelled 'Bangkok Airways Employee & More', apparently exposing airline staff data. Airline employee records are valuable for targeted phishing and credential abuse against a critical transport operator. The airline and its partners should assess exposure and monitor whether more data is released.Leak● 63
Filtración de base de datos de la farmacia rusa VITA (1,9M)The DarkForums user Mr_Raccoonn posted a September/October 2026 database allegedly holding 1.9 million records from Russian online pharmacy Vitaexpress.ru. Pharmacy datasets typically include customer names, contacts, addresses and order or prescription-related data, exposing both the company and its clients to fraud and phishing. Defenders should verify the breach, track resale of the records and warn affected customers.Leak● 52
Presunta filtración de datos de usuarios mexicanos de CoinbaseA DarkForums post advertises what it claims are millions of Coinbase account records belonging to Mexican citizens, dated early November 2026. If authentic, the dataset would fuel credential-stuffing and account-takeover attempts against crypto holdings of Mexican users. Financial and crypto defenders in Mexico should monitor reuse of these credentials.