Underground · what matters today

Filtración de base de datos de República Dominicana

República Dominicana

A Dominican Republic database containing 6.8M and 5.6M images was posted on DarkForums minutes ago, a fresh country-scale exposure. If it holds national IDs or citizen photos it enables identity theft, fraud and impersonation across the country. Regional defenders should verify scope and monitor for reuse of the affected data.

Base de datos NetProspex filtrada y publicada para descarga

NetProspex

The NetProspex B2B marketing contact database has been reposted for public download on BreachForums. It contains business contacts and firmographic data rather than fresh breach material, so its operational value is limited. This is a well-known, older leak rather than a new incident.

Filtración de la base de datos del servicio de ebooks Bookmate

Bookmate

A database belonging to Bookmate, a social ebook subscription service, has been posted on DarkForums for download. The dump may expose account and subscription data for a large reader base, enabling credential-stuffing and phishing. Bookmate and its users should treat the service as potentially compromised and rotate credentials.

Filtración gratuita de base de datos de ciudadanos de Ecuador

Ecuador (base de datos de ciudadanos)

A full Ecuadorian citizen database is being freely distributed on BreachForums, posted today, exposing national identity records of the country's population. This kind of PII leak enables identity fraud, SIM-swap, and targeted attacks against citizens and state services, and can be reused to attack government authentication flows. Defenders in Ecuador and the region should treat it as a fresh, high-impact national data exposure.

Base de datos de 428 escuelas de Panamá publicada en dark web

Escuelas de Panamá

A dataset covering 428 Panamanian schools has been offered on a dark web forum, indicating a compromise of educational-sector records. Such data often includes staff, student and contact details useful for phishing and social engineering. Panamanian education authorities should treat this as a live exposure and assess its origin.

Filtración de base de datos del sistema mexicano SIINAFE (57K registros)

SIINAFE (México)

A 57,000-record database belonging to the Mexican SIINAFE system has been published for download on a dark web forum. The dump appears fresh and targets a public-sector entity, meaning citizens' personal data may already be exposed. Mexican government defenders should confirm the breach and scope of affected records.

Filtración de 16 bases de datos educativas de Brasil

Instituciones educativas de Brasil

A bundle of 16 Brazilian educational databases has been shared for download on a dark web forum. The content is relevant to LATAM public data exposure but the post dates to July 2026 and is therefore not a fresh alert. Brazilian education-sector defenders should still validate whether their records appear in the dump.

Base de datos corporativa del ERP brasileño FRM Sistemas filtrada

FRM Sistemas

A 159 MB corporate database belonging to Brazilian ERP provider FRM Sistemas has been published on a dark web forum. ERP dumps typically contain customer, financial and business-partner records that can fuel fraud and further intrusions. Brazilian organizations using this vendor should assume exposure and review third-party risk.

Base de datos y código fuente de Legiit.com a la venta

Legiit.com

A seller is offering the Legiit.com database together with its source code, exposing customer accounts and proprietary backend code. Leaked source code can reveal hidden vulnerabilities and enable exploits or platform cloning, while user data enables credential stuffing and phishing. Affected users should rotate credentials and audit for exposed secrets.

Filtración de 21.145 cuentas de Binance

Binance

A fresh post offers a database of 21,145 Binance account records from a 2026 crypto leak. Exposed credentials and account data enable account takeover, SIM-swap and phishing attacks against exchange users, and can be monetized to drain funds. Binance users and counterparties should force password resets and verify MFA.

Base de datos de 87 mil estudiantes de Panamá filtrada

Estudiantes de Panamá

A database containing 87,000 Panamanian student records has been posted for download on a dark web forum, likely tied to the national education sector. Personal data of minors and academic records carry high privacy and fraud risk for the affected population. Defenders in Panama's public sector should verify provenance and prepare breach notification.

Filtración de archivo .env con credenciales de SATTNORD

SATTNORD

A BreachForums leak post dated October 11 exposes an .env configuration file allegedly belonging to SATTNORD, which typically contains API keys, database credentials and tokens. Such secrets can grant direct access to backend systems and third-party services. The named organization should rotate all keys and secrets referenced in the file immediately.

Volcado SQL de la empresa brasileña topsay.com.br

topsay.com.br

A SQL dump of the Brazilian company topsay.com.br was posted on DarkForums, dated June 2023. While the data relates to a Latin American firm, the post is over three years old and likely already circulated, so it is not a fresh alert. Worth noting for exposure history only, not for immediate response.

Filtración de base de datos del CREFRS de Rio Grande do Sul

CREFRS (Conselho Regional de Educação Física do Rio Grande do Sul)

A database belonging to CREFRS, Brazil's Rio Grande do Sul Regional Council of Physical Education, is being offered in the DarkForums leak section. The dump likely exposes registrants' names, documents and contact data, enabling identity fraud and targeted phishing against a regulated Brazilian professional body. Affected parties should confirm scope and warn members.

Base de datos de 14,5 millones de usuarios de Robinhood a la venta

Robinhood

A DarkForums post advertises a leaked database of 14.5 million Robinhood users hosted on US servers. If genuine, it would expose large volumes of retail brokerage customers' personal and financial data for fraud and account-takeover campaigns. The claim must be verified against known breaches, but its scale warrants urgent attention.

Filtración de datos de terceros de una empresa turca de ciberinteligencia

Empresa turca de CTI (sin nombre)

A forum user is leaking third-party data reportedly tied to a Turkish cyber threat intelligence company, posted only minutes ago. Even partial exposure of a CTI vendor's internal or client data can reveal investigative sources and partner relationships. Analysts should monitor for further dumps naming affected clients.

Filtración de base de datos de empleados del aeropuerto de Riad

Aeropuerto de Riad (Arabia Saudita)

A database of Riyadh Airport employee records is being offered for download on BreachForums, exposing staff names and contact data from a government-adjacent transport operator. Though outside Latin America, it matters for aviation-sector defenders since the leaked employee details enable targeted phishing and credential attacks.

Base de datos de Telegram de 200 millones de líneas a la venta

Telegram users

An actor is advertising a Telegram database of more than 200 million lines, likely phone and user records, on a cybercrime forum. Data of this size fuels large-scale smishing, account takeover and impersonation campaigns. It is global in scope and the post is several weeks old, so treat it as background rather than a fresh alert.

Filtración de datos de OSINT Industries tras un hackeo

OSINT Industries

OSINT Industries, a platform widely used by investigators and law enforcement for open-source lookups, has reportedly been hacked with a database posted on a dark-web forum. Compromise of an OSINT provider can expose customer identities, queries and sensitive investigative interests. This is a fresh, potentially high-impact leak for CTI and government users.

Filtración de base de datos de ADT con 30.000 registros y SSN

ADT

A database labelled ADT is circulating with 30,461 rows, 15,326 emails and 30,236 SSNs. ADT is a major security-services firm, so exposed SSNs and emails create real identity-theft and phishing risk for its customers. Monitor for downstream fraud and brand impersonation.

Filtración de 2 TB de datos de Israel liberada gratis

A 2TB dataset said to originate from Israel is being released for free, indicating a very large breach of unknown scope and content. Free large leaks spread quickly and drive credential stuffing and extortion. Though not regional, its size warrants tracking in case it contains government or telecom data.

Filtración de datos de First Citizens Bank con 12.760 SSN

First Citizens Bank

A database attributed to First Citizens Bank is circulating with 13,076 rows, 12,760 SSNs and 1,099 emails. A financial institution leaking customer SSNs and emails faces account-takeover and identity-fraud risk. The bank should verify exposure, notify customers and watch for phishing and credential stuffing.

Venta de 4,8 millones de registros de estudiantes de Florida

Florida Department of Education (FLDOE)

A seller is offering 4.8 million student records from the Florida Department of Education (FLDOE), including SSNs, dates of birth and full names. The scale and presence of SSNs and minors' data make this a serious identity-theft and fraud risk. US education defenders should watch for credential stuffing and impersonation.

Bases de datos de usuarios de Binance de varios países a la venta

Binance

A seller advertises Binance customer databases for the UK, New Zealand, Denmark and Australia, posted around April 2026. If authentic, leaked exchange records fuel account takeover, phishing and KYC fraud. It is months old, so it is not a fresh alert.