BRIEFLeakhighP48
US Social Security Administration SSN data for sale
Social Security Administration (SSA)
Detected7 November 2026 · 07:43 UTC
A seller on DarkForums claims to be offering SSN data attributed to the US Social Security Administration, a federal agency. If authentic, exposure of Social Security numbers can fuel identity theft and tax fraud at scale. The claim is unverified and scale/date are unclear, but it names a high-value government target and warrants scrutiny.
CategoryLeak
Severityhigh
Priority score48
Detected7 November 2026 · 07:43 UTC
LeakPriority 45
Filtración de base de datos del Instituto Politécnico Nacional (ipn.mx)User s4100n published a database titled 'ipn.mx' in the Leaks/Databases section of DarkForums, referring to the domain of Mexico's Instituto Politécnico Nacional, a public national education institution. The thread dates from 10 June 2026, so it is already several months old, and neither the record count nor the data fields are disclosed. Leaked academic and staff records from a public institution enable credential stuffing, phishing and account takeover affecting students and employees.LeakPriority 42
Base de datos con PII de clientes mexicanos de Cosmotienda filtradaPoster 'Jaded' shared a Freebie on BlackBones Carding Forum advertising what is described as a 2026 Mexican PII database belonging to Cosmotienda, a Mexican cosmetics retailer. The post dates from 23 August 2026 and no record count, data fields or sample are provided, so the real scale is unverified. Customer PII of Mexican consumers supports phishing, identity fraud and account takeover, and triggers data-protection obligations for the retailer.LeakPriority 40
Filtración de base de datos del Partido Baaz de Irak y SiriaA database attributed to the Iraq/Syria Socialist Ba'ath Party was offered for download on BreachForums, potentially exposing membership or personnel records of a politically sensitive organization. The post provides no clear date or record count, so its recency and scale cannot be confirmed. It is mainly relevant for regional political-risk and counter-intelligence monitoring rather than for AR-LATAM defenders.LeakPriority 48
Publican 18.000 cuentas de Coinbase filtradasA set of roughly 18,000 Coinbase accounts was published on DarkForums by user Zannokar on November 1, 2026 in the cracked-accounts section. Crypto exchange accounts are prime targets for account takeover and direct theft, and leaked credentials fuel credential-stuffing and phishing against users. The moderate size limits impact but the financial sector should watch for credential reuse.LeakPriority 74
Filtración de 7,4 millones de registros de Apteka.ruA 7.4 million record database belonging to Apteka.ru, a major Russian online pharmacy, was posted for download on DarkForums by user UNC6783 on November 7, 2026. Pharmacy databases typically hold customer names, contact details, addresses and order/health-related data, creating a high-value privacy and fraud exposure. Defenders should treat this as a fresh, large-scale leak relevant to credential-stuffing and phishing campaigns.LeakPriority 45
Filtración de base de datos del gobierno de Irak (rss.gov.iq, 100 GB)A xReactor.org thread references a 100GB leak of the rss.gov.iq government database dated August 2026. If genuine, it represents a substantial exfiltration of Iraqi public-sector records with potential PII and account data. It is dated a few months back and concerns a non-LATAM target, so it is relevant mainly as background rather than a fresh alert for AR-LATAM defenders.