BRIEFLeakhighP62
Colombian SQL database dumps posted on DarkForums
Colombia (SQL databases via sharedproxy.co)
Detected6 November 2026 · 13:43 UTC
A DarkForums thread advertises SQL database dumps tied to Colombian websites, distributed through the sharedproxy.co handle, and has since been closed by moderators as removed content. SQL-level dumps from regional services typically contain user tables, password hashes or plaintext credentials and internal identifiers that enable follow-on intrusion. Colombian organisations should determine whether their own systems are represented in this collection.
CategoryLeak
Severityhigh
Priority score62
Detected6 November 2026 · 13:43 UTC
LeakPriority 55
Presunta filtración de datos de contratistas militares y de gobiernoA DarkForums post claims a 'fresh breach' full data dump of 100M+ records attributed to Raptor Supplies, described as covering military, government and civilian contractors. The claim is unspecific and resembles aggregator-style marketing, so scale and authenticity are unconfirmed. If genuine, contractor credentials and procurement data could expose supplier accounts used by defence and public-sector buyers.LeakPriority 88
Filtración de 3 TB de datos de la energética brasileña Bel EnergyActor SUB-ZER0 posted on DarkNetArmy a claimed full dump (over 3TB, ~12M client records) from Bel Energy/Belenus, a Brazilian solar energy distributor. The dataset is advertised as financial and energy-sector client data, which points to CRM, billing and customer records. For defenders this is a critical-infrastructure-adjacent leak in Brazil requiring LGPD notification and credential/fraud monitoring.LeakPriority 40
Presunta filtración de datos de 100.000 usuarios de un banco de Estados UnidosA LeakForum post offers a file described as full user information for 100,000 customers of an unnamed US bank, labelled as fresh. The vendor does not name the institution and provides no sample evidence, so authenticity and scale cannot be verified from the thread. Defenders at US financial institutions should still watch for credential reuse and identity-fraud activity consistent with such a dataset.LeakPriority 80
Base de datos de Laboral.com.ar de Argentina a la venta con 6,8 millones de registrosAn actor on DarkForums is advertising a dump allegedly extracted from LABORAL.COM.AR, an Argentine employment portal, claiming 6.8 million recent records from 2026. Data of this kind typically includes names, emails, phone numbers and credential material for jobseekers, which directly enables phishing and credential stuffing against individuals and corporate clients. The thread is now flagged as removed content, meaning the file may be circulating privately rather than in the open forum.LeakPriority 40
Datos de usuarios y pedidos de la app Coinbase filtradosA DarkForums thread claims data from a Coinbase-branded app covering about 7.5 million orders and 1.8 million users. The content is login-walled, so scope and authenticity are unverified, but the claimed volume is significant. Analysts should confirm whether genuine Coinbase customer data is involved before escalating.LeakPriority 46
Filtración de 82 millones de direcciones de Yuantong ExpressA dataset of roughly 82 million address records belonging to Chinese courier YTO Express (yto.net.cn) was posted on DarkForums by user cfqsdscqsdcqsc. Such logistics data typically includes names, phones and delivery addresses, enabling targeted phishing and fraud. It signals a large supply-chain exposure relevant to e-commerce and parcel-security teams.