Underground · what matters today

Base de 837.000 leads de Binance a la venta

Binance

A seller offers 837,000 'fresh' Binance-related leads, dated June 2026, on a dark web forum. Such lists fuel targeted phishing, SIM-swap and account-takeover campaigns against crypto users. It is roughly four months old, so treat it as context rather than an active alert.

Filtración de base de datos de empleados de STMicroelectronics

STMicroelectronics

A thread shares field-level structure of an STMicroelectronics employee database dated 2025, suggesting a breach of the semiconductor firm. Employee records enable targeted phishing and social engineering against a strategic technology supplier. The post is old, so it is background context rather than an active alert.

Base de datos de 2,2 millones de Bank of America a la venta

Bank of America

A forum listing claims a 2.2 million-record database tied to bankofamerica.com is being sold. If genuine, it exposes customer PII usable for phishing, account takeover and card fraud against a major financial institution. The post dates to around April 2026, so it is not a fresh alert but still worth verifying exposure.

Base de datos de la agencia de viajes brasileña Hurb filtrada y disponible

Hurb

The database of Hurb, a major Latin American online travel agency (formerly Hotel Urbano), is being shared for download on BreachForums. A dump of this scale exposes large volumes of customer PII, enabling fraud and targeted phishing. Though a Hurb breach was reported earlier, this fresh public posting revives exposure for the affected users.

Filtración de base de datos de Akademia Knauf Brasil (13.000 registros)

Akademia-knauf.com.br

A database from Akademia-knauf.com.br, the Brazilian portal tied to building-materials giant Knauf, was leaked in roughly 13,000 lines. It exposes user account data of a Latin American corporate entity, enabling phishing and credential-stuffing against employees and partners. Brazilian and regional organizations should treat this as a live, in-region leak.

Nuevo volcado de registros de stealer White Cloud (9,7 GB)

A 9.7 GB collection of fresh stealer logs dated 8 Oct 2026 has been posted, aggregating credentials and session data harvested by infostealers across many victims. Such logs directly fuel account takeover and initial-access operations against many organizations. Defenders should check whether their users' credentials appear in this dump.

Venta de datos del gobierno francés (gouv.fr) en foro de brechas

Gobierno de Francia (gouv.fr)

A BreachForums seller is advertising data allegedly tied to French government domains (gouv.fr). Government datasets commonly contain internal directories, staff credentials or citizen records that enable follow-on intrusion and phishing against public institutions. The scope is unconfirmed and the post lacks a clear recent date, but any gov-domain exposure should be verified and monitored.

Filtración de la base de datos del comercio brasileño Moobrio

Moobrio (moobrio.com.br)

A database allegedly belonging to Brazilian retailer moobrio.com.br is being shared on DarkForums. The thread dates from December 2024, so this is stale rather than a fresh incident. If the records are customer PII they could support fraud and phishing against Brazilian consumers, but urgency is low.

Filtración de 2.870 millones de usuarios de Twitter/X en un dataset de 450GB

Twitter/X (X Corp)

A cleaned dataset of roughly 2.87 billion Twitter/X user records (~450GB) is circulating on BreachForums. It looks like a repackaged version of the older 2023 Twitter scrape rather than a new breach, so alerting value is limited. It still feeds email/phone enumeration and targeted phishing against X users, so brand and fraud teams should be aware.

Filtración de la base de datos del sitio social BookCrossing

BookCrossing

A database for the social and book-sharing site BookCrossing is being offered in DarkForums' leak section in a freshly posted thread. If genuine it would expose member account and profile data, enabling credential stuffing and phishing. Scale is unclear, but the recency warrants a quick look by brand-protection and fraud teams.

Filtración de base de datos de la firma fiscal Tobin & Company

Tobin & Company

A database attributed to US firm Tobin & Company (tax, auditing and consulting) is advertised on DarkForums. Tax and accounting firms hold sensitive client PII and financial records, making such a leak valuable for fraud and business email compromise. It is outside the AR-LATAM region but worth tracking for affected clients.

Filtración de 20 millones de credenciales URL:login:contraseña

A 20-million-line credential dump (URL:login:password) is being distributed free on a Russian-language forum, dated 10 October 2026. Mega-leaks of this size fuel credential-stuffing and account-takeover against any organisation whose users reused passwords. Defenders should reset exposed credentials and watch for anomalous logins.

Filtración de 20 millones de credenciales URL:login:contraseña

A freshly posted dump offers 20 million URL:login:password stealer-log entries dated 10 Oct 2026. Credential sets of this size fuel credential-stuffing and initial-access attempts against many organizations and may include corporate SSO or portal logins. Defenders should monitor for reuse of leaked credentials against internet-exposed services.

Filtración de base de datos de Winamax con 563.659 clientes

Winamax.fr

A threat actor is leaking a database of 563,659 customers of the French online betting site Winamax.fr. The dataset exposes personal data of users, enabling phishing, account takeover and regulatory exposure for the operator. Betting accounts often tie to payment and identity data, compounding the fraud risk for affected customers.

Base de datos de consumidores de EE. UU. con 106.000 registros a la venta

A 106,000-record US consumer database is being shared on the xReactor forum, exposing personal and likely contact data of US individuals. The volume is modest and the target is outside Latin America, so regional impact is limited. No date is visible, suggesting this is a repost rather than a fresh event.

Filtración de datos de 555.000 propietarios de viviendas de Francia

A 555,000-record dataset described as French homeowner data is being traded on RaidForums, likely containing names, addresses and contact details. It is a sizable PII leak useful for phishing and identity fraud, though the victim base is outside Latin America. No clear post date is shown, so recency is unverified.

Base de datos de 365 GB de la firma neozelandesa Tas NZ Bay a la venta

Tas NZ Bay Limited (tasnz.co.nz)

RaidForums lists a 365GB database allegedly belonging to Tas NZ Bay Limited, a New Zealand company (tasnz.co.nz). A dataset of that size can contain corporate records, PII and internal documents that enable further intrusion, fraud or extortion. The public offering of a real company's full dataset warrants tracking even outside the LATAM region.

Combolist de 52.179 credenciales de Chile publicado en foro

A freshly posted combolist contains roughly 52,179 email/password pairs attributed to Chile. The volume is modest, but the set can fuel credential-stuffing and account-takeover against Chilean online services and public portals. Defenders should screen for password reuse and force resets on affected accounts.

Venta de base de datos de la plataforma educativa española Fiction Express (725 GB)

Fiction Express

A seller is offering a 725 GB database allegedly belonging to Fiction Express, a Spanish digital reading and education platform used by schools. Such a volume could expose student, parent and teacher accounts plus internal data across many institutions. Education-sector defenders in Spain should watch for credential reuse, phishing against schools, and account-takeover attempts.

Base de datos de Standard Gas con 4M de registros a la venta

Standard Gas

A threat actor is selling a database of about 4 million records attributed to Standard Gas. The data fields are unverified, but if it holds customer or operational information it enables targeted phishing and fraud. Any energy-sector victim also raises the possibility of critical-infrastructure exposure.

Divulgación de brecha de datos de Pathao Limited

Pathao Limited

An actor is publishing an ongoing breach disclosure against Pathao, a major Bangladeshi ride-hailing, delivery and payments platform. The continuing nature suggests active access and further exfiltration, affecting a large base of users and drivers. Exposed PII and payment data could drive fraud and account takeover.

Base de datos de Mecourier (EAU) con 31M de registros a la venta

Mecourier (mecourier.ae)

A seller is offering a database of roughly 31 million records allegedly taken from Mecourier, a UAE courier and logistics company. If authentic, it exposes customer names, contact details and delivery data, fueling phishing, SIM-swap and fraud campaigns. Large logistics datasets also help attackers map operational and vendor relationships.

Base de datos de OpenCorporates republicada en un foro

OpenCorporates

The full OpenCorporates corporate registry dataset has been reposted, a large aggregation of company and officer records useful for identity fraud and B2B targeting. The post is dated August 2025, so it is a stale re-post rather than a fresh breach. Still relevant for data-exposure and third-party risk tracking.

Volcado de 2,8 millones de credenciales de stealer logs (URL:LOGIN:PASS)

A dump of about 2.8 million URL:LOGIN:PASSWORD records, likely harvested by infostealers, was posted. Such credentials enable credential stuffing and initial access against corporate email and VPN portals. Organisations should check exposure and force resets on affected accounts.