Underground · what matters today

Base de datos de tarjetas de Banamex México a la venta

Banamex (Citibanamex)

A threat actor is advertising a database of Banamex (Citibanamex) cardholders in Mexico, posted just minutes ago. If genuine it exposes payment-card records for one of Mexico's largest banks, enabling card fraud and targeted phishing. LATAM banking defenders should treat this as a fresh, high-impact card-data exposure and verify controls.

Filtración de base de datos de Argentina, Perú y México

A forum user posted a claimed database leak covering Argentina, Peru and Mexico just minutes before discovery, indicating fresh and possibly large regional data. The specific victim, record count and data types are not yet confirmed, but multi-country LatAm leaks often bundle citizen, consumer or corporate PII. Defenders in AR/PE/MX should monitor for credential and PII exposure and validate whether their organization's data appears.

Filtración de 89 millones de credenciales URL:login:contraseña

A member is publishing a very large stealer-log compilation of URL:login:password entries, claimed at 89 million lines. Credential dumps this size fuel credential-stuffing and account-takeover campaigns across many services. Defenders should enforce MFA and monitor for spikes in failed logins against their user base.

Venta de datos de 43.000 residentes de Probolinggo, Indonesia

Residents of Probolinggo, Indonesia

A seller is advertising 43,000 identity records belonging to residents of Probolinggo, Indonesia, likely including national ID and personal data. Bulk PII of this kind enables identity fraud and targeted phishing against the affected population. It also suggests a possible compromise of a regional government or service-provider database.

Filtración de datos de operaciones de vuelo de aerolíneas de EE. UU.

US airlines

A forum user posted what is described as US airline flight operations data, a dataset touching aviation logistics and scheduling. If genuine, exposure could reveal routes, schedules and operational details useful for disruption or fraud. Aviation operators and their suppliers should verify exposure and monitor for downstream abuse.

A la venta base de 89 millones de credenciales URL:LOGIN:PASS

A seller is dumping a roughly 89-million-entry URL:LOGIN:PASS combo of stealer-log style credentials sourced from infected hosts. It is a large commodity credential set rather than a breach of a specific named organization, so it mainly fuels credential-stuffing. Value is limited unless defenders cross-reference their own domains against it.

Volcado fresco de registros stealer de 743 MB publicado en foro

A 743 MB dump of infostealer logs was posted today on DarkForums, likely containing credentials, cookies and session data harvested from infected machines. Fresh stealer logs of this size often feed account-takeover and initial-access campaigns against corporate and government targets. Defenders should hunt their users' and organizations' credentials in the dump before it is weaponized.

Filtración de datos de empleados de TI de StarMedica México

StarMedica México

StarMedica, a Mexican private hospital chain, is reportedly leaking data tied to its IT department employees. If valid, threat actors could reuse credentials and internal details for phishing or lateral access into healthcare infrastructure. Health-sector targets in Latin America are prime for ransomware, so this warrants validation and credential-reset advice.

Base de datos filtrada de Phone House España

Phone House España

The Phone House España customer database is circulating for download on a RaidForums clone. Spanish retailer data (names, contact and potentially payment details) can fuel fraud and phishing against Spanish-speaking victims. However the sample appears to be an older leak, so it is not a fresh alert for LATAM defenders.

Base de datos con 39.000 periodistas marroquíes expuesta

An actor is dumping a database covering roughly 39,000 Moroccan journalists alongside 30 PDFs, framed as the 'Pegasus state' leaving data open. Such exposure endangers journalists, sources and press-freedom networks, and can enable reprisals and targeted surveillance. It is relevant for cross-border surveillance and media-threat monitoring even outside AR-LATAM.

Venta de datos CSV de la Facultad de Ciencias de la UNAM

UNAM - Facultad de Ciencias (México)

The same actor (LulzSkid) is advertising a CSV of UNAM's Facultad de Ciencias for sale on BreachForums, indicating a monetized leak of a Mexican public university's data. These datasets typically carry student/staff PII and institutional credentials that can fuel phishing and account takeover. It warrants alerting Latin American education and public-sector defenders to monitor for misuse of UNAM-linked identities.

Filtración de datos CSV de la Facultad de Ciencias de la UNAM

UNAM - Facultad de Ciencias (México)

A BreachForums actor (LulzSkid) published a CSV dataset belonging to the Facultad de Ciencias of the National Autonomous University of Mexico (UNAM), a flagship Latin American public institution. While the exact record count is not stated, university CSVs usually hold student, academic and staff PII such as names, institutional emails, IDs and possibly password hashes. Defenders in Mexican public-sector and education organizations should treat this as a fresh breach and hunt for exposed credentials and PII reuse.

Filtración de 7,5 millones de registros de clientes de Momentum Telecom

Momentum Telecom

A 7.5M-record customer PII database attributed to Momentum Telecom was freshly posted for download. The data reportedly includes names, home addresses and city details, enabling large-scale phishing, SIM-swap and account-takeover campaigns against subscribers. Telecoms are critical infrastructure, so defenders should correlate the claims with internal breach indicators and notify affected customers.

Filtración de datos del Gobierno de Mendoza con más de 1M de registros PII

Gobierno de Mendoza, Argentina

A threat actor posted a database allegedly containing over 1 million PII records belonging to the Government of Mendoza, Argentina, freshly advertised on a leak forum. If authentic, it exposes citizen and employee personal data of a provincial government body, enabling phishing, identity fraud and targeted intrusion against public administration. Argentine government entities should urgently validate the exposure and watch for credential abuse and follow-on attacks.

Filtración masiva de 110M de credenciales URL:usuario:contraseña

A freshly dated dump claims 110 million URL:login:password stealer-log records, marked private and UHQ. Credential re-use makes this useful for account takeover, credential stuffing and initial access across many organizations. Despite being generic, its scale and recency warrant surfacing for defensive monitoring.

Filtración de datos de 7,5M de clientes de Momentum Telecom

Momentum Telecom

A freshly posted leak claims 7.5 million customer PII records from Momentum Telecom, including names and home addresses. Although the company is US-based, a dataset of this size is a high-value asset for fraud, SIM-swap and phishing campaigns. Defenders in telecom and downstream sectors should monitor for credential and identity abuse.

Base de datos de clientes de AT&T (correo y ubicación) publicada

AT&T

A collection labelled as an AT&T customer base with email addresses and location data was posted on a leak forum. If authentic and current it would represent a large exposure of a US telecom subscriber base, but it may be a repost of earlier AT&T breach data, so its age should be verified before alerting. Telecoms are critical infrastructure, so any fresh customer-data leak warrants monitoring.

Filtración masiva de 110 millones de credenciales de stealer logs

A 110-million-record URL:login:password dump sourced from stealer logs was posted, likely aggregated infostealer output rather than a single breach. While it names no victim, its sheer volume hands attackers a large pool of valid credentials for credential-stuffing against corporate and government accounts worldwide. Defenders should enforce MFA and monitor for reuse of credentials originating from this dump.

Base de datos de 23,5 millones de ciudadanos de Taiwán (2022) recirculada

Taiwán

A 23.5M-row Taiwan citizens database originally leaked in October 2022 is being recirculated. It is old, so not a fresh incident, but the scale and government-linked PII keep it valuable for identity fraud and social engineering. Treat it as historical context, not an active alert.

Combolist de 2,8 millones de credenciales filtradas

A large 2.8 million-line ULP (email/password) combolist has been posted. While generic and undated, its size makes it useful for credential-stuffing campaigns against services with password reuse. Defenders should enforce MFA and monitor for reuse of these credentials on exposed logins.

Base de datos de 417.000 contactos de empresarios de EAU a la venta

A vendor is selling a 417k-contact database of UAE business owners, likely harvested from directories or registries. Business-contact lists fuel BEC, investment and phishing scams targeting executives. Low-technical but monetizable, it is worth noting for regional fraud monitoring.

A la venta 100.000 registros de transacciones de PayPal de EE. UU.

PayPal

A seller is offering a database of roughly 100,000 US PayPal transaction records, posted fresh today on DarkNetArmy by an unverified account. If authentic, it exposes payment, identity and account data that enable fraud, account takeover and targeted phishing. Defenders should treat it as a potential leak of payment PII and monitor for reuse of the listed accounts.

Filtración de SCADA/HMI de una línea de embotellado en Francia

A collection labeled as a SCADA/HMI system for a beer bottling and automated packaging line in France is being shared. Industrial control dumps reveal PLC/HMI details, credentials and network layouts that enable disruptive attacks. Asset owners should audit exposed interfaces and rotate PLC/HMI credentials.

Base de datos de 1,4 millones de usuarios de Propertyfinder.ae a la venta

Propertyfinder.ae

A seller is offering a 1.4 million-record database of Propertyfinder.ae, a major UAE real-estate platform. The dump likely contains names, emails and phone numbers, enabling phishing, real-estate fraud and account takeover. Large regional PII leaks like this get reused fast by fraud and spam campaigns.