Underground · what matters today
The underground stories that broke through this window. Gov/mil, access sales, ransomware, leaks, stealers. Screenshots and context on each.
Distribution by category · window
- Gov / Military51
- Access sale27
- Ransomware17
- Leak382
- Stealer0
- Other4
Window
Category
Severity
Base de datos de clientes de Optum a la venta
Optum.com
A customer database attributed to Optum.com is being offered on the forum, indicating a leak at a major US healthcare services company. Healthcare customer data is highly sensitive and fuels medical fraud and targeted phishing. It is a sizable, named-organization leak worth surfacing to defenders.
Filtración de base de datos del Colegio Mexicano de Nutriólogos
colegiomexicanodenutriologos.org.mx
A database of roughly 584,000 records from colegiomexicanodenutriologos.org.mx is being leaked, containing personal and contact data. It affects a Mexican professional organization and its members, exposing PII usable for phishing and fraud. It is a LATAM-relevant leak worth tracking even if not government or critical infrastructure.
Filtración de datos del hospital Thye Hua Kwan (Singapur)
Thye Hua Kwan Hospital
A data collection linked to Singapore's Thye Hua Kwan Hospital (Ang Mo Kio) is circulating on BreachForums. Healthcare records are highly sensitive, so any leak of patient or staff data raises privacy and regulatory risks. The scale is unclear, so treat it as a possible breach to confirm with the affected organization.
Filtración de base de datos de la operadora Vodafone
Vodafone
A database attributed to telecom operator Vodafone is being distributed on the Spear Leaks forum, dated mid-2026, with a thread spanning nine pages. The size suggests a substantial dump of subscriber or corporate records. Because telecom operators are critical infrastructure, defenders should verify the data and prepare customer notifications and credential-reset plans.
Base de datos de IKEA a la venta en foro clandestino
IKEA
A forum user posted a claimed IKEA database for sale, indicating a possible breach or resale of the retailer's data. If authentic, it could expose customer or internal records usable for phishing, credential stuffing and account takeover. Given IKEA's global footprint it should be validated and monitored even though the source and scale are unconfirmed.
Base de datos con identidad completa de 596.652 ciudadanos mexicanos a la venta
Ciudadanos mexicanos (CURP / INE)
A threat actor is offering a full identity database of 596,652 Mexican citizens, including CURP, INE voter ID, home address and personal data. Government-issued identity records at this scale enable mass identity theft, fraud, loan/credit abuse and impersonation of voters. Defenders in Mexico and LATAM should treat this as a high-priority exposure and validate its authenticity.
Filtración de la base de datos de Artsy
Artsy
A database described as the Artsy online art marketplace has been posted in a forum leaks section. The scale and date are unclear, but a real company database leak can expose customer and account data used for credential stuffing. Worth verifying and adding to monitoring if confirmed.
Filtración de 21.145 cuentas de Binance
Binance
A database of roughly 21,145 Binance accounts is being circulated on a breach forum under a 2026 label. While the volume is modest, crypto-exchange credentials fuel account takeover, wallet draining and follow-on phishing. Exposed users should be flagged for credential rotation and monitoring.
Filtración de SCADA/BMS del hospital Thye Hua Kwan de Ang Mo Kio
Thye Hua Kwan Hospital (Ang Mo Kio, Singapore)
A collection labeled as the Building Management System (BMS) and SCADA system of Ang Mo Kio–Thye Hua Kwan Hospital in Singapore has been posted on a breach forum. If authentic, it exposes operational-technology data controlling building systems in a healthcare facility, a critical-infrastructure setting. Defenders should treat it as a possible OT-access vector and verify whether the data is genuine and current.
Filtración de datos de empleados de McDonald's India
McDonald's India
A database of McDonald's India workers was leaked and made available for download, exposing staff personal data. Such records enable identity fraud and targeted phishing against employees. The post dates to 2025, so it is not a fresh alert, but the data may still be reused against affected individuals.
Filtración de datos de Systech USA publicada en DarkForums
Systechusa.com
A dataset from Systech USA was published on DarkForums for free download, exposing internal company data. Although the exact scale is unclear, leaked corporate data fuels fraud and follow-on intrusions. It is worth tracking for credential reuse and possible supply-chain exposure.
Filtración de 327.000 contactos del portal jordano Akhtaboot
akhtaboot.com
A 327k-record database from the Jordanian job portal Akhtaboot is circulating, exposing professional contacts and likely account data. Recruitment portals are prime targets for targeted phishing and BEC. Affected organizations and users should be warned and credentials reset.
Filtración de datos de pacientes de Alles Lægehus/We.Care (Dinamarca)
Alles Lægehus / We.Care
A dataset exposing 150k+ patient and employee records from the Danish healthcare group Alles Lægehus/We.Care has been posted. Health data is highly sensitive and regulated, raising extortion and GDPR exposure. Defenders should watch for credential reuse and targeted phishing against clinical staff.
Base de datos de 850 millones de usuarios de China Mobile a la venta
China Mobile
A database with over 850 million unique China Mobile subscriber records is being offered via a carding forum, one of the largest telecom leaks seen. Names, phone numbers and related PII at this scale enable SIM-swap, phishing and account-takeover campaigns. Defenders in telecom and fraud teams should treat it as recycled PII/credential material driving downstream attacks.
Presunto atacante expone brecha de datos de Pathao (Bangladesh)
Pathao
An actor published a message addressed directly to Pathao management about what they call a "partial data breach", implying a database dump, extortion or a follow-up leak of the Bangladeshi super-app. Pathao runs ride-hailing, food delivery and payments for millions of users, so any customer data exposure can fuel fraud and credential-stuffing across the region. Even though the scale is unconfirmed, defenders should verify exposure and watch for the data being published or sold on the same forum.
Filtración de base de datos de donaciones de la Cruz Roja Mexicana
Cruz Roja Mexicana
A dataset of roughly 46,670 donation records tied to the Mexican Red Cross is being offered for sale on DarkForums. It includes donor personal and payment-related data from a humanitarian organization in LATAM. Donor lists are valuable for phishing and financial fraud, so the entity should be alerted to validate and disclose the breach.
Base de datos de clientes de Wells Fargo a la venta
Wells Fargo (EE. UU.)
A DarkForums listing claims to share a full Wells Fargo customer list, targeting a major US bank. Large-bank database sales are often recycled or fraudulent, but if legitimate the impact on identity theft and downstream fraud is severe. Worth tracking and validating the sample before acting.
Base de datos de clientes de Banco Azteca a la venta
Banco Azteca (México)
A seller on DarkForums is advertising a complete customer list allegedly exfiltrated from bancoazteca.com, one of Mexico's largest retail banks. If genuine, it exposes the personal and financial data of millions of account holders to fraud and account-takeover. A leak of this scale against a major LATAM bank warrants immediate verification and customer-notification planning.
Filtración de base de datos de 100 GB del gobierno de Iraq (rss.gov.iq)
rss.gov.iq (Iraq)
A 100 GB database belonging to the Iraqi government portal rss.gov.iq was published for download in August 2026. If authentic, it exposes sensitive state records and demonstrates successful compromise of a national government system. The case is relevant when assessing similar exposure of government assets in Latin America.
Base de datos de 70 millones de usuarios de Telegram a la venta
Telegram
A database claiming to hold 70 million Telegram users' data is being distributed on BreachForums. Identifiers at this scale (phone numbers, usernames) fuel phishing, SIM-swap and account-takeover campaigns worldwide, including Latin America. Telegram's popularity in the region makes the exposed data directly actionable for attackers.
Filtración de documentos de RRHH del call center Radius Global Solutions en Panamá
Radius Global Solutions (Panamá)
A full set of HR documents from Radius Global Solutions' call center in Panama has been published on a leak forum, exposing employee personal and payroll data. The material enables identity theft and social-engineering campaigns against staff in the region. Any organization with Panamanian operations should verify whether its data is included.
Filtración de bases de datos de DATASUS y DENATRAN de Brasil a la venta
DATASUS / DENATRAN (Brasil)
A DarkPro carding thread advertises combined dumps of Brazil's DATASUS public-health system (149M records) and DENATRAN traffic authority (104M records), both core government datasets full of citizen PII. If genuine and current, this would supercharge identity fraud, SIM-swap and phishing against Brazilian residents, but the material resembles previously leaked 2021 data, so verify freshness before treating it as a new breach.
Filtración de base de datos de la petrolera estadounidense Red Star Oil
Red Star Oil
A leaked database attributed to Red Star Oil, a US fuel and bulk gasoline provider, is being offered on a hacking forum. Customer and contact data, and possibly order records, could enable social engineering and fraud. It sits outside the LATAM region but is relevant as a fuel-sector data exposure.
Filtración de datos de clientes bancarios de Francia con IBAN
Clientes bancarios de Francia
A dump of French bank customer records containing IBANs is circulating on a hacking forum. IBAN data combined with identity details enables direct-debit fraud and highly targeted phishing against account holders. Fraud teams and CERT-FR should validate the leak's scope and warn affected customers.