BRIEFLeakhighP52
Dump of 13 million Canadian citizen records
Canadá
Detected16 September 2026 · 08:12 UTC
A 13 million-record dump of Canadian citizen data is circulating in underground forums. Identity data of this scale fuels identity theft, benefits fraud and account takeover across the population. Although outside AR-LATAM, it is a landmark government-scale leak that CTI teams should track for reused data and linked campaigns.
CategoryLeak
Severityhigh
Priority score52
Detected16 September 2026 · 08:12 UTC
Leak● 40
Presunta base de datos de 820 millones de usuarios de Alipay a la ventaA DarkForums thread by user Vinkeval claims to offer a full database of 820 million Alipay users, one of the largest payment platforms in China. Claims of this scale on Alipay have circulated for years and are frequently recycled or fabricated, so the sample needs validation before any conclusion about real exposure. If genuine, it would be among the largest credential and identity leaks ever seen in fintech.Leak● 46
Base de datos del Observatorio Parlamentario de Irak filtradaA DarkForums user (Zarlotor) publishes a database attributed to the Iraq Parliamentary Observatory, a legislative-monitoring body. Exposed records of parliamentary staff, contacts and monitoring work can support social engineering against legislators and interference operations. The volume and verification level are unclear, but it is a fresh government-adjacent leak worth cataloguing.Leak● 60
Presunta filtración de documentos y datos de usuarios de BinanceA DarkForums user (Raxmusen) posts what is claimed to be Binance internal documents and customer data under a 'Binance leak 2026' thread. If authentic, exposed KYC-style records of a major exchange fuel SIM-swap, account-takeover and extortion attempts against crypto users, including many in Latin America. Claims of this kind are often recycled, so verification of the sample's freshness is essential before alerting.Leak● 62
Filtración gratuita de datos de la aerolínea Plus UltraA DarkForums post offers for free a data set belonging to Plus Ultra, the Spanish airline operating routes to Venezuela and other Latin American destinations. Airline data typically includes passenger identities, itineraries and contact details, useful for phishing and travel-fraud campaigns across Spain and LatAm. The release being free maximises downstream abuse, so regional airlines and travel-sector defenders should assess quickly.Leak● 68
Base de datos de clientes del club La Reserva de Sotogrande a la ventaA DarkForums actor (Zynxeutov) advertises an 'exclusive 2026' database of La Reserva Club Sotogrande, a high-end golf and real-estate club in southern Spain, claiming data on wealthy clients. If genuine, it exposes high-net-worth individuals' contact and membership details, a prime target list for phishing, fraud and extortion. Defenders and private-banking/real-estate partners in Spain should verify exposure and warn affected clients.Leak● 42
Múltiples filtraciones en operadores de telecomunicacionesA DarkForums post bundles alleged leaks from multiple telecom operators, a critical-infrastructure sector. Telecom data exposes subscriber records and network details attractive for fraud and further intrusion; however the operators and scope are not specified in the listing. Defenders should obtain the sample to identify any regional carriers involved.