Underground · what matters today
The underground stories that broke through this window. Gov/mil, access sales, ransomware, leaks, stealers. Screenshots and context on each.
Distribution by category · window
- Gov / Military51
- Access sale28
- Ransomware17
- Leak382
- Stealer0
- Other4
Window
Category
Severity
Filtración de base de datos del Gobierno de Tierra del Fuego
Gobierno de Tierra del Fuego (gob.ar)
A database reportedly belonging to the Tierra del Fuego provincial government (tierradelfuego.gob.ar) is being advertised on DarkForums with roughly 200,000 records. The post is fresh (published minutes ago), indicating newly exfiltrated government data from an Argentine state body. This warrants immediate validation and containment: it may expose citizen PII, internal credentials, or citizen-service records usable for follow-on intrusion.
Base de datos del Ejército de Bangladesh a la venta
Bangladesh Army
A seller listed a database belonging to the Bangladesh Army in a marketplace forum, dated April 2026, making it a stale offer rather than a fresh alert. If authentic, military contact and personnel data could aid targeted attacks or phishing against defence staff. Because the post is months old, treat it as background context rather than an urgent incident.
Filtración de correos del Gobierno de Serbia
Serbian Government
A user claims to have leaked email addresses belonging to the Serbian government, posted only hours ago. Government email lists enable targeted phishing and credential attacks against public officials even without passwords. It is outside Latin America, but illustrates ongoing gov-targeting and should be verified to spot follow-on attacks.
Filtración de datos de la policía de Abu Dabi y Dubái
UAE Abu Dhabi & Dubai Police
A freshly posted thread (about 5 hours ago) claims leaked data from Abu Dhabi and Dubai police forces. Police datasets typically contain officer identities, contact details and operational information that enable targeting and social engineering. Though outside LATAM, it is a government breach worth tracking for TTP and data-reuse patterns.
Filtración de documentos internos del Ejército de EE. UU.
US Army
A forum user posted a file claiming to be leaked US Army documents, though volume and sensitivity are unverified. Internal military documents can expose operations, personnel or procurement data useful for espionage. Analysts should obtain the sample, verify authenticity and assess real operational impact.
Filtración de base de datos de la Policía de La Rioja, Argentina
Policía de la Provincia de La Rioja (Argentina)
A database attributed to the La Rioja Provincial Police is circulating on BreachForums, exposing officer and staff records from an Argentine security force. Leaked police PII enables targeted phishing, doxxing and intelligence gathering against a regional law-enforcement body. Treat this as a live PII/credential exposure and warn affected units.
Filtración de base de datos del gobierno de Pesisir Barat
Gobierno de Pesisir Barat (pesisirbaratkab.go.id)
A free dump of the database behind pesisirbaratkab.go.id, the government of Pesisir Barat regency in Indonesia, is being circulated on a breach forum. Government datasets typically hold citizen PII, staff records and internal contacts. This enables identity theft and targeted phishing against public-sector staff and residents.
Filtración de documentos internos del Gobierno y Ejército de Arabia Saudí
Gobierno y Fuerzas Armadas de Arabia Saudí
Internal documents from Saudi Arabia's military and government are being circulated on a breach forum across several pages. Leaked government/military material can expose operational plans, personnel and sensitive infrastructure details. Even outside LATAM it is high-value, state-level intelligence worth monitoring.
Base de datos de empleados del Ministerio de Salud de Malasia
Ministerio de Salud de Malasia
A BreachForums thread offers a database of Malaysia Ministry of Health employees, exposing staff identities and contact data of a national health authority. Government health bodies are high-value targets for phishing and credential abuse. The post lacks a clear date but appears current, so the agency should verify scope and notify staff.
Documentos internos filtrados del Ministerio de Cultura de Marruecos
Morocco Ministry of Culture
Internal documents from Morocco's Ministry of Culture have been leaked and made downloadable on a dark web forum. Government internal documents can expose personnel, contracts and infrastructure details useful for further intrusion. Although outside Latin America, the government-sector nature makes it notable for monitoring.
Filtración de 400K registros de gobiernos de La Rioja y Entre Ríos
Gobiernos provinciales de La Rioja y Entre Ríos (.gob.ar)
A seller posted a 400,000-record dataset allegedly taken from the Argentine provincial government domains rioja.gob.ar and entrerios.gob.ar. It exposes citizen and administrative data from two provincial governments, enabling identity theft, targeted phishing and further intrusion. Argentine public agencies should urgently verify the exposure and rotate credentials.
Filtración del Ministerio Coordinador de Economía de Indonesia
Ministerio Coordinador de Asuntos Económicos de Indonesia
A DarkForums leak thread targets the Indonesian Coordinating Ministry for Economic Affairs, a government body, indicating exfiltration of official data. Government leaks can expose officials, internal communications and policy documents usable for espionage or social engineering. Although not Latin American, it demonstrates a live gov-sector leak worth cataloguing for regional context.
Filtración de base de datos de Seguridad de Turquía
Dirección General de Seguridad de Turquía
A database attributed to Turkey's General Directorate of Security is being offered on DarkForums, posted only minutes ago. If authentic, it would expose law-enforcement personnel records, a high-value target for fraud, doxxing and social engineering. Although outside Latin America, it signals active government-sector data leaks worth tracking for regional trends.
Actualización de filtración de 207 GB de la Policía Nacional Bolivariana
Policía Nacional Bolivariana (Venezuela)
A 207.5 GB collection attributed to Venezuela's Bolivarian National Police (PNB) has been re-posted with a January 2026 update, exposing law-enforcement data. Although the material is months old rather than fresh, it remains a high-value government dataset useful for targeting officials and mapping police operations. It is worth noting for context but is not a time-sensitive alert.
Filtración de 200.000 registros del gobierno de Quintana Roo
Gobierno de Quintana Roo, México (quintana.gob.mx)
A database dump of 200,000 records attributed to quintana.gob.mx, the official domain of the Quintana Roo state government in Mexico, was posted very recently. Government records of this size can expose citizen PII and internal accounts, enabling phishing, identity theft and follow-on intrusion. Mexican public-sector defenders should validate the claim and hunt for leaked credentials.
Filtración de la base de datos de la eléctrica estatal de Ecuador
Corporación Nacional de Electricidad (CNE), Ecuador
A freshly posted DarkForums thread exposes a database belonging to Ecuador's Corporación Nacional de Electricidad, the state-owned power utility and designated critical infrastructure. The leak of national energy-sector data can enable targeted attacks, credential abuse and fraud against grid operations and customers. Defenders should immediately verify exposed credentials and watch for anomalous access to CNE systems.
Filtración de base de datos de Misiones.gob.ar y RENAPE.gob.ar
Misiones.gob.ar / RENAPE.gob.ar
Two Argentine government platforms were leaked: Misiones.gob.ar (provincial government portal) and RENAPE.gob.ar (national health providers registry), about 206,000 records. It likely exposes citizen and provider data tied to public health and provincial administration. Defenders should expect phishing, identity fraud and follow-on intrusion against government systems.
Filtración de base de datos del gobierno de Formosa (formosa.gob.ar)
Gobierno de Formosa (formosa.gob.ar)
An actor posted a fresh database dump of roughly 100,000 records allegedly exfiltrated from the Argentine provincial government site formosa.gob.ar. The thread was published moments ago, indicating an active and recent compromise of a public-sector .gob entity. Defenders in the AR public sector should treat this as a live incident, check for credential reuse and exposed citizen/administrative data.
Filtración de datos de estudiantes del Ministerio de Educación de Marruecos
Ministry of Education of Morocco
A poster claims to hold student data belonging to Morocco's Ministry of Education, a national government body. Leaked education records typically include minors' names, IDs and contact details, raising privacy and identity-fraud risks. The government target makes it a notable state-sector data exposure even outside the region.
Filtración de datos de la Presidencia del Consejo de Ministros de Italia
Italian Prime Minister's Office
A poster claims to have leaked data from Italy's Prime Minister's Office, a top-tier government body. Government executive data leaks can expose internal communications, staff records and sensitive planning. Although outside Latin America, the target's seniority makes it relevant for monitoring state-targeting actors.
Base de datos del Departamento de Seguridad Nacional de EE.UU. (DHS) filtrada
US DHS
A database labelled as belonging to the US Department of Homeland Security (DHS) has been posted for download. If genuine, exposure of DHS data would be a major national-security event; even if inflated, it warrants verification. Track it for authentication details and downstream credential reuse against government systems.
Código fuente del sitio del gobierno de España (PSOE.es) filtrado
PSOE.es
Source code for the Spanish Socialist Party (PSOE.es) government website has been published, potentially exposing application logic, hardcoded secrets, API keys and internal endpoints. Leaked source code lets attackers hunt for vulnerabilities and access paths into a live political and government platform. Defenders should review it for exposed secrets and patch the disclosed code paths.
Filtración completa del webmail del Gobierno de Brasil (gov.br)
Gobierno de Brasil / gov.br
A full dump of the Brazilian federal government's gov.br webmail is being offered, allegedly containing complete credentials for civil servants across ministries. If authentic, it enables mass account takeover of official e-mail, powering espionage, internal fraud and lateral movement into connected government systems. Brazilian public-sector defenders should treat this as an urgent credential compromise and force resets plus MFA.
Hackeo de servidores de la Policía de Sri Lanka
Sri Lanka Police Department
The poster claims multiple internal servers of the Sri Lanka Police Department were compromised, exposing law-enforcement systems and data. A police breach can expose citizen records, officer identities and operational systems, enabling follow-on intrusion or extortion. Fresh and worth tracking for regional law-enforcement impact.