BRIEFLeaklowP45
21Bitcoin customer data from a 2026 breach offered for sale
21Bitcoin
Detected2 November 2026 · 05:24 UTC
A seller on RaidForums is offering '21Bitcoin Crypto Leads 2026 Breach Data', described as customer records from the Bitcoin broker. Exchange customer data fuels account-takeover attempts, KYC-themed phishing and 'your funds are at risk' extortion aimed at crypto holders. Volume and freshness are not confirmed in the listing, so it should be verified before customer notification.
CategoryLeak
Severitylow
Priority score45
Detected2 November 2026 · 05:24 UTC
Leak● 45
Base de datos española con IBAN ofrecida en DarkForumsA DarkForums thread is offering a Spanish database containing IBANs, i.e. full account numbers usable for fraudulent direct debits and payment fraud. Neither the volume, the fields nor the originating financial institution are stated, so attribution and impact remain limited. Still, leaked IBANs are direct fuel for transfer fraud and impersonation against Spanish banks.Leak● 58
Base de 980.000 filas con códigos de embajadas y bancos a la ventaA BreachForums seller (pfavre) is offering 980,000 rows of physical-security data, including door codes and access protocols, allegedly obtained from a Swiss secure-destruction and assembly service and covering embassies, major banks, telecoms and private villas. If genuine, the data enables physical intrusion rather than only data theft, raising the risk for diplomatic and corporate facilities. Country distribution is unknown, so Latin American missions and bank branches should be treated as potentially in scope.Leak● 70
Base de datos de Perú con más de 500.000 registros a la ventaA seller using the handle OscarElMasCapito is offering a Peruvian database of more than 500,000 records on BreachForums, including full names, national ID (DNI) numbers, ages and income data. The source organisation is not named, but the combination of DNI and income details is ideal for identity fraud, loan scams and impersonation. Peruvian banks and public services should expect credential stuffing and social engineering built on this data.Leak● 86
Base de datos de la Provincia de Tierra del Fuego a la ventaThe user OscarElMasCapito has published a database attributed to the Provincial Government of Tierra del Fuego on BreachForums, pointing to an exfiltration from Argentine official systems. The volume and fields are not disclosed, but a provincial administration holds citizen records and internal operational data. For defenders the priority is confirming exposure, identifying the source of the leak and tracking how the data is reused.Leak● 38
Presunta filtración de datos del National Bank of PakistanA DarkForums thread offers leaked data attributed to the National Bank of Pakistan, a state-owned bank, but the post is undated and unverified. Banking customer records are prime material for account takeover, fake-call fraud and card abuse, and any confirmed breach of a national bank carries systemic risk. Without samples or a date, it should be treated as an unconfirmed claim.Leak● 42
Circulación de 400 millones de líneas de datos scrapeados de LinkedInA 400-million-line LinkedIn dataset scraped in 2026 is being circulated on DarkForums as a paid download. Scraped profile data maps real people to employers and roles, feeding spear-phishing, recruiter-lure fraud and credential stuffing against corporate staff. It is aggregated public data rather than a fresh intrusion, so its operational novelty is limited but the identity mapping is valuable.