BRIEFLeakhighP50
Sale of passport and ID scans from Europe, America, Asia
Detected16 September 2026 · 14:12 UTC
A vendor is selling bulk scans and photos of passports and national IDs covering Europe, America, Asia and the Russian Federation. This is a large identity-document trove that enables fraud, KYC bypass and account takeover, and may include Latin American documents. Defenders should treat it as an identity-fraud risk and monitor for impersonation and document misuse.
CategoryLeak
Severityhigh
Priority score50
Detected16 September 2026 · 14:12 UTC
Leak● 62
Filtración de datos del prestamista hipotecario New American FundingOn 31 October 2026 the actor Jarkilon published a 'New American Funding leak' database thread on DarkForums, naming the large US mortgage lender. The listing implies borrower and applicant PII — names, contacts and loan/financial data — was exfiltrated, a high-value asset for phishing and identity fraud. US financial-sector defenders and the lender's customers should treat the data as exposed.Leak● 65
Ministerio del Interior de Taiwán: base de 23,57M de ciudadanosBreachForums sellers listed a 'full citizens' extract of Taiwan's Ministry of the Interior register, claiming 23.57 million records at 100% coverage (now marked sold out). If genuine, it exposes national ID, address and household data for essentially the entire adult population, enabling identity fraud and social engineering. Taiwanese government bodies and any service relying on citizen-ID verification should treat this data as compromised.Leak● 56
Base de datos de la promotora malasia Mah Sing Group a la ventaThe actor scarlettgroup posted a database belonging to Mah Sing Group Berhad (mahsing.com.my), a major Malaysian property developer, on DarkForums on Sunday 1 November 2026. Dumps of this type typically contain customer, sales and employee records useful for targeted phishing and fraud. Malaysian real-estate firms and the company's customers should verify the leak and monitor for misuse.Leak● 62
Base de datos del diario uruguayo la diaria a la ventaA cybercriminal thread on an onion forum advertises a database belonging to la diaria, a Uruguayan independent newspaper (ladiaria.com.uy). The thread is login-walled so the record count and price are unknown, but a media outlet in the region is a plausible target for subscriber and staff credential exposure. Leaked newsroom or subscriber data enables phishing against journalists and can be reused for account takeover.Leak● 30
Publicada una brecha de sitios .gov.ma (Marruecos)The actor 'fexus' posted a thread on BreachForums titled '.gov.ma websites breach', indicating data from Moroccan government sites. However, the post is dated mid-May 2026, roughly six months before today, so it is not a fresh alert and the specifics of the leak are not detailed in the captured text. It is a government-sector exposure but outside the Argentina/LatAm focus and already stale.Leak● 45
Filtración de 200.000 credenciales corporativas de Alemania (D4RKNETHUB)The D4RKNETHUB actor is distributing 'Part (6)' of a dataset containing roughly 200,000 German corporate email:password records, reposted across several forums including DarkNetArmy, Niflheim and HARD-TM. These mail:pass combos are directly usable for credential stuffing, account takeover and business email compromise against German companies. Fresh corporate credential sets like this are actively exploited for phishing and unauthorized access.