Underground · what matters today

Filtración de 6,2 millones de clientes de la aerolínea TAP (flytap.com)

TAP Air Portugal / flytap.com

A database of roughly 6.2 million customers of Portuguese flag carrier TAP (flytap.com) is being shared, exposing passenger names, contacts and likely booking details. Large airline leaks fuel targeted phishing, fraud and account takeover. Affected travellers and the airline's partners should be warned.

Base de datos de social-formula.com (200K) a la venta

social-formula.com

A seller is listing a roughly 200K-record database belonging to social-formula.com, a US-targeted property, on a darkweb marketplace. The scale is moderate and the entity is a commercial site rather than a critical-infrastructure or government target. It is worth tracking as a real-organization leak but is low priority outside its user base.

Base de datos de 687.000 registros de BCD Travel a la venta

bcdtravel.com

A freshly posted listing offers a 687,000-record database attributed to BCD Travel, describing corporate travel management data pulled via Salesforce. Corporate travel and employee contact data at this scale fuels phishing, BEC and credential-stuffing against the travel and corporate sector. BCD Travel and its corporate clients should treat affected credentials as compromised and hunt for downstream login abuse.

Filtración de 1,1 millones de registros de Cushman & Wakefield

cushmanwakefield.com

A new listing advertises a 1.1 million-record dataset from Cushman & Wakefield, a global commercial real estate firm, attributed to Salesforce and dated 2026. Datasets of this size typically contain business contacts, emails and client records valuable for targeted phishing and account takeover. The firm and its partners should assess exposure and monitor for credential misuse.

Filtración de logs del sistema HRMS del Metro de Noida

Noida Metro Rail Corporation (NMRC)

A threat actor posted logs from the HRMS (Human Resource Management System) of the Noida Metro Rail Corporation, a critical urban transport operator. Exposure of HR/identity records and internal system logs enables credential reuse, phishing and lateral movement against a government-owned infrastructure entity. The post is fresh (minutes old), so defenders should treat it as an active alert and rotate any implicated credentials.

Filtración de 16 millones de credenciales en registros de stealer

A 16-million-line URL:login:password stealer-log dump is posted for free, aggregating credentials harvested by infostealers. Although no single organization is named, the scale makes credential-stuffing and account takeover against any exposed user highly likely. Defenders should search for their domains and force resets of affected sessions.

Filtración de base de datos del banco mexicano Banorte

Banorte (Grupo Financiero Banorte)

A Banorte database is being distributed for free on BreachForums with a direct download link. Banorte is one of Mexico's largest banks, so exposed customer records create serious fraud, identity-theft and follow-on account-takeover risk. LatAm financial defenders should treat any credentials and PII in this dump as compromised.

Filtración de 16 millones de credenciales de Secretline.top

Secretline.top

A free dump labelled Secretline.top claims over 16 million URL:login:password credential lines, a classic stealer/credential-log set. While such mass dumps are often recycled, exposed combinations fuel credential stuffing against corporate webmail, portals and cloud services.

Filtración de 5,6 millones de logs de stealer de Lupin

A VIP-section dump released on 2026-10-10 contains over 5.6 million worldwide stealer-log lines harvested by infostealer malware. These credential-and-session records let attackers pivot into corporate VPNs, email and SaaS accounts, so defenders should treat exposed credentials as compromised.

Filtración de base de datos de e-topplus.kr: 28 millones de registros

e-topplus.kr

A full database dump of the Korean site e-topplus.kr is being published, containing roughly 28 million lines of PII such as full name, date of birth, address and phone. This volume of identity data enables large-scale fraud, phishing and account takeover across a whole user base.

Filtración de 15 TB de documentos clasificados del INSS israelí

Israel INSS (national security)

A forum actor claims to have leaked 15 TB of classified documents tied to Israel's INSS national security body, likely the Israeli National Insurance Institute. Even if only partly genuine, data of this scale from a state security agency can fuel espionage, targeting and disinformation against government systems.

Filtración completa de la base de datos de e-topplus.kr

e-topplus.kr

A full database leak of the Korean site e-topplus.kr is circulating, claiming about 28 million lines with full names, dates of birth, addresses and phone numbers. The volume and PII fields make it a serious identity-theft and fraud risk for millions of South Korean users. Defenders should confirm authenticity and monitor for downstream abuse.

A la venta filtración de datos bancarios de 1paysolution.com

1paysolution.com

A forum seller is advertising an 'online banking data breach' of 1paysolution.com for sale, potentially exposing customer banking credentials and financial records. Banking data leaks fuel account takeover and payment fraud. Financial-sector defenders should confirm scope and force credential resets for affected users.

Filtración de datos de mypcp.us a la venta

mypcp.us

A seller posted on 2026-10-07 offering a data breach from mypcp.us for sale, indicating a fresh compromise of user or customer records. If it involves personal or health-adjacent data, affected users face identity theft and targeted phishing, and the sale means the dataset may be weaponized quickly.

Filtración completa de la base de datos del minorista surcoreano e-topplus

e-topplus (e-topplus.kr)

A full database dump of South Korean retailer e-topplus.kr, roughly 28 million lines with full names, dates of birth, addresses and phone numbers, is being circulated for download. The scale and PII richness make it highly valuable for identity theft and targeted phishing against Korean users. Although outside the LatAm region, it is a large fresh leak worth tracking for downstream credential-reuse exposure.

Filtración de base de datos de la plataforma de e-commerce Tiendup

Tiendup

A threat actor published a downloadable dump of Tiendup, a Chilean SaaS e-commerce platform widely used across Latin America, exposing customer and order data. Store owners and shoppers linked to the platform face PII and credential exposure and follow-on fraud risk. LatAm defenders should flag Tiendup-linked accounts as compromised and watch for credential reuse.

Filtración de 20 millones de emails por bucket AWS abierto de IMDataCenter

IMDataCenter

A BreachForums post reports 20 million unique emails exposed through an open AWS bucket and lead list belonging to IMDataCenter. Because the dataset is shared for free, it significantly lowers the barrier for spam, phishing and credential-stuffing campaigns. Defenders should monitor for downstream abuse of these addresses even though the post date is unclear.

Filtración de 26,5 millones de registros de Vertafore (Texas Lien Records)

Vertafore

A BreachForums thread offers a 26.5 million-row dataset labeled as Vertafore Texas lien records. Vertafore is a US insurance-software provider, so this likely contains personal and property data of US policyholders and lien holders. Defenders should treat the exposure as a phishing and identity-fraud risk, though the exact post date is unknown and the data could be stale.

Base de datos de Brasil publicada en BreachForums

Brasil (organización no identificada)

A user posted a thread titled "Brazil DB" on BreachForums on 10 October 2026, apparently offering a Brazilian database for sale. The exact organization, sector and record count are not disclosed in the snippet, so scope is unknown. Because Brazil is a priority LATAM target, a fresh dump like this could expose citizen or corporate records worth monitoring for regional defenders.

Filtración de base de datos de Bombordo Group, Brasil

Bombordo Group (Brasil)

A database from the Brazilian nautical consulting and school Bombordo Group was posted to DarkForums by user P4R4ZYT3. The affected entity is a small private company, so the strategic impact is limited despite being a Latin American target. It is worth noting mainly for regional coverage and possible credential reuse.

Filtración de base de datos de SNCF Rémi Val-de-Loire, Francia

SNCF Rémi Val-de-Loire (Francia)

A database tied to the French regional rail service SNCF Rémi Val-de-Loire was posted by DarkForums user l0cked. It concerns a public transport operator, so exposed operational or customer data could enable fraud and lateral access. It is outside the AR-LATAM region, so it ranks below regional alerts but remains a genuine org leak.

Filtración de base de datos del Sanatorio San Gerónimo, Argentina

Sanatorio San Gerónimo (Argentina)

A database belonging to the Argentine healthcare provider Sanatorio San Gerónimo was posted to DarkForums by user Synq1xxss and appears fresh (minutes old). The leak exposes patient and administrative data from a regional hospital, a critical-sector target in Argentina. Defenders should treat it as an active breach and validate exposure and credential reuse.

Filtración de datos del gobierno de Angra dos Reis (RJ), Brasil

Angra.rj.gov.br

A data leak attributed to the Brazilian municipal government domain angra.rj.gov.br was posted to DarkForums by user Ziehadblackhat. It concerns a public-sector body in Latin America, which is relevant, but the post is dated May 2024 and is therefore stale. It should be tracked as historical exposure, not a fresh alert.

Venta de brecha de datos de Health Time (España): 2,2 millones

Health Time (España)

A seller offers a 2.2 million-record breach from Spanish healthcare provider Health Time, exposing patient and medical data. Health records are sensitive and can fuel fraud and extortion across Spain. However, the post dates to May 2026, so it is not a fresh alert but still worth tracking for affected parties.