Underground · what matters today

Reaparición de la filtración BidenCash de 1,2 millones de tarjetas (2023)

BidenCash

This thread reposts the BidenCash dump of 1.2 million credit cards, which is explicitly dated 2023 and was already leaked years ago. It was only re-shared recently, so it is not a fresh compromise and card issuers have long since acted on those BINs. Useful only as historical reference, not as an active alert.

Filtración de 105K registros de Inter Mutuelles Habitat (Francia)

Inter Mutuelles Habitat (ima.eu)

A 105K-record database from French social-housing provider Inter Mutuelles Habitat (ima.eu) has surfaced, exposing tenant and beneficiary personal data. Housing records reveal vulnerable populations and are usable for phishing and fraud. Modest scale and already a few months old, so it is a secondary item.

Filtración de datos de 176K agentes gubernamentales en E-campus (Francia)

E-campus Intérieur (Francia)

A 176K-record database of French government agents linked to the E-campus Intérieur platform is being leaked. Government-employee PII, including professional details, is high value for spear-phishing and impersonation against public administration. Even outside LATAM, it demonstrates a government-targeting pattern worth tracking.

Bases de datos de seguros de salud de Taiwán y Corea a la venta

Seguros de salud de Taiwán y Corea

A seller advertises fresh healthcare-insurance databases from Taiwan and South Korea, a sector with strict privacy sensitivity. Leaked insurance data fuels medical identity fraud and targeted extortion of policyholders. Worth tracking for the sector and for cross-border fraud exposure.

Base de datos de fortalezas.org de Brasil (742K contactos) a la venta

fortalezas.org (Brasil)

A seller is offering a 742K-record database from Brazil's fortalezas.org containing personal contacts and professional profiles. The scale and personal-data content make it valuable for phishing, identity fraud and targeting Brazilian individuals and organizations. LATAM defenders should watch for credential-stuffing and impersonation abuse.

Volcado de base de datos de 655GB de radiax.com a la venta

radiax.com

A 655GB database attributed to radiax.com was posted fresh on a hacking forum, signalling a major exfiltration of the site's data. The sheer volume implies a large-scale breach likely affecting many user records or backend/operational data. Defenders should verify exposure and monitor for downstream credential abuse against the victim and its supply chain.

Filtración de la base de datos de Remote3.co

Remote3.co

A second-version dump of the Remote3.co crypto jobs platform has been published for free download on a leak forum, exposing registered accounts and associated user data. The crypto focus makes these credentials valuable for account takeover and follow-on fraud. Defenders should check for corporate emails in the dump and force password resets.

Volcado de registros de stealer con credenciales (14.10.2026)

A fresh daily dump of infostealer logs and user:password lists (U.L.P) was posted on 14 Oct 2026, harvested from machines infected by stealer malware. No specific organisation is named, but such dumps routinely contain corporate VPN, webmail and SaaS credentials that enable account takeover and initial access. Defenders should ingest it for credential-exposure monitoring of their domains.

Filtración de la base de datos de la plataforma cripto Remote3.co

Remote3.co

A full database dump of the Remote3.co crypto platform (V.2) has been posted for download on a leak forum, apparently a second, larger release. It likely contains user records such as emails, hashed credentials and account metadata, which fuel credential-stuffing and account takeover. Defenders should watch for re-use of these credentials and for resale of the data on combolist feeds.

Base de datos de 10 millones de ciudadanos de Portugal a la venta

Ciudadanos de Portugal

A 10-million-record Portuguese citizen database is listed for sale on a darknet forum, dated early September 2026. Data at this scale likely includes national identifiers, addresses and other PII covering a large share of the population. It enables mass identity fraud and targeted phishing, affecting any organization with Portuguese customers or staff.

Filtración de datos y SSN de la Cruz Roja (redcross.org)

Red Cross (redcross.org)

A listing claims 18,008 rows from redcross.org including 10,050 emails and 17,812 SSNs. Although small in scale, exposed SSNs of Red Cross personnel or volunteers enable identity theft and targeted fraud. Worth only a low-priority watch.

Filtración de 2,48 millones de perfiles de Pathao (Bangladesh)

Pathao (Bangladesh)

A dataset of 2.48 million Pathao user profiles from Bangladesh, with Facebook/Apple-linked accounts, is being shared. Exposed PII plus third-party login links enable credential stuffing and account takeover. It is a large leak of a real organization and still worth tracking.

Filtración de 21 TB de la noruega Alpha IT (servicios TI)

Alpha IT (Noruega)

A 21 TB dataset attributed to the Norwegian IT services and software-testing firm Alpha IT has been posted for leak. The volume suggests source code, client data and internal systems, a supply-chain style exposure that can affect Alpha IT's customers. Its scale makes it a priority even outside Latin America.

Filtración de 6,4 millones de clientes de Bouygues Telecom

Bouygues Telecom (Francia)

A database of 6.4 million Bouygues Telecom customer records dated 2025 is being offered on a darkweb forum. Telecom providers are critical infrastructure, so exposed subscriber data fuels SIM-swap, phishing and account-takeover against millions of users. Treat it as a fresh, high-volume leak.

Filtración de base de datos del banco nigeriano Zenith Bank

Zenith Bank

A database from Zenith Bank Plc, one of Nigeria's largest banks, is being offered in a leaks section. The post is dated March 2026, so it is roughly seven months old and not a fresh alert. It still has value for defenders tracking re-use of leaked banking customer data, but urgency is low.

Filtración de base de datos del sitio diet.com

diet.com

A thread posted within minutes offers a database taken from diet.com, a diet and nutrition website, in a leaks section. The recency suggests a freshly exfiltrated dataset from a real company. Customer emails, credentials and preference/health data are attractive for credential stuffing and phishing campaigns.

Venta de datos de Ampath Laboratories (Sudáfrica)

Ampath Laboratories

A seller is offering data belonging to Ampath Laboratories in the Zululand region of South Africa, a major pathology-lab network, in a thread posted roughly an hour ago and signed with PGP. The listing is fresh and actively traded, which is the key alerting signal. Lab/diagnostic data is highly sensitive because it can expose patient health information.

Filtración de base de datos de Ampath Laboratories en Sudáfrica

Ampath Laboratories (Zululand, Sudáfrica)

A fresh database attributed to Ampath, a major South African pathology laboratory network covering the Zululand region, was published for download on a darkweb forum only minutes before discovery. Healthcare lab breaches typically expose patient names, national IDs, contact details and test/metadata, enabling medical identity fraud and highly targeted phishing. Health-sector defenders and any partner handling Ampath data should treat this as an active, recent data exposure requiring validation and credential/patient notification readiness.

Reaparece una recopilación de la brecha de datos de Uber US

Uber

An 'Uber US Data Breach' collection has resurfaced for download on a BreachForums thread, but it appears to be a repackaging of previously known or old Uber data rather than a fresh intrusion. Treat it as low priority and verify novelty before issuing any alert.

Filtración de la base de datos de Printavo

Printavo

A BreachForums thread advertises a full dump of the Printavo database for public download. Printavo is a US SaaS platform used by thousands of print and apparel shops, so the leak likely exposes customer, order and payment records. Affected businesses should assume credential and PII compromise and rotate keys.

Base de datos de usuarios de Coinbase a la venta

Coinbase

A cracked-market seller claims to offer a Coinbase database of 109,392 users with balances. If genuine, it is high-impact material for account takeover of crypto holders, enabling theft and SIM-swap follow-ups. Crypto platforms and their users should force password/2FA resets and monitor for targeted phishing.

Filtración de datos de Manhattan Parking Group

Manhattan Parking Group

A BreachForums post publishes the data of Manhattan Parking Group for download. The group operates numerous parking facilities in New York, so the leak can expose customer PII, vehicle and payment data. Operators should treat credentials as compromised and check for webshell or RDP persistence.

Filtración de 1,1 millones de registros robados (ULP)

User EvenRoad posted a fresh pack of roughly 1.1 million stolen credential logs (ULP: URL, login, password) on DarkForums. While it names no specific victim, the volume is significant for credential-stuffing and account-takeover campaigns. It is a fresh dump worth ingesting for exposure monitoring rather than a targeted alert.

Datos filtrados del Pentágono publicados en un foro

Pentagon / US DoD

A DarkForums post titled 'Pentagon Leaked Data' claims to expose sensitive material tied to the US Department of Defense. If genuine it would be a major military data exposure; however the listing gives no sample, scale or date, so it may be recycled or fake. Analysts should verify authenticity before acting, but the claim warrants monitoring.