BRIEFLeaklowP36
Private sale of a 6.9M-line URL:LOG:PASS credential dump
Detected15 November 2026 · 21:13 UTC
A 6.9 million line URL:LOG:PASS set is being distributed as a private, high-quality credential dump on xReactor. It aggregates stolen logins tied to web addresses, which enables credential stuffing and account takeover across many services at once. There is no named victim organization, so impact is diffuse but broad; organizations should assume some employee credentials may be included.
CategoryLeak
Severitylow
Priority score36
Detected15 November 2026 · 21:13 UTC
LeakPriority 32
Índice de búsqueda ULP con 3,62 millones de credenciales en NulledBBA 3.62 million entry URL:LOGIN:PASS dataset is offered on NulledBB as a searchable ULP index, letting buyers query stolen logins by domain. This makes targeted account takeover far easier than a raw combolist. No specific victim is named, so the risk is generic credential exposure affecting many organizations at once.LeakPriority 55
Filtración de la base de datos SpainDB con 300.000 personasOn 15 November 2026 the user 'syx171' published 'SpainDB', a database covering roughly 300,000 Spanish individuals, in the DarkForums leak section. Population data of this kind typically fuels phishing, identity fraud and credential-stuffing against banks and online services. Spanish organizations should check whether their users appear in the dataset and warn affected customers.LeakPriority 90
Filtración de 400 GB de datos del ayuntamiento de Cancún (cancun.gob.mx)The user 'arcepah' published a 400 GB database allegedly belonging to the Cancún municipal government (cancun.gob.mx) on DarkForums on 15 November 2026. Municipal data can include citizen records, internal documents and credentials, enabling identity fraud and follow-on intrusion into government systems. Defenders should verify the leak against exposed assets and watch for credential reuse.LeakPriority 50
Filtración de 6,9 millones de credenciales URL:LOG:PASSActor cloudmarket_pro published a 6.9 million line URL:LOG:PASS dataset labelled private and UHQ on DarkForums in November 2026, and the same dump is being reshared on other forums. Each line maps a login URL, username and plaintext password, which is directly usable for credential stuffing against corporate VPNs, webmail and SaaS portals. Because the scope is not segmented by organization, defenders must assume employees of any sector may be included.LeakPriority 56
Filtración de la base de datos de la Universidad de MadridOn 15 November 2026 the actor syx171 published a 'DATABASE Universidad Madrid' thread on DarkForums, the same account that posted a Spanish hospital dump minutes earlier. The dump likely contains academic and staff accounts plus personal data of students, which enables phishing and credential stuffing against university services. The duplicate thread posted two minutes later suggests active promotion of the same dataset.LeakPriority 63
Filtración de base de datos de un hospital de EspañaThe user 'syx171' posted on DarkForums on 15 November 2026 a database allegedly belonging to a Spanish hospital. Healthcare records are highly sensitive and valuable for fraud and extortion, and a breach can expose patient and staff data. Spanish health-sector defenders should confirm the scope and monitor for downstream misuse.