Underground · what matters today

Filtración de sistemas SCADA de una estación de servicio en EE. UU.

A leak labeled TRK25 exposes SCADA/industrial systems of a US gas station, including HMI or control-logic data. Exposed OT details can reveal network topology, default credentials and process controls useful for sabotage. OT defenders should review remote access and segment control networks immediately.

Filtración de base de datos de la minorista estadounidense JCPenney

JCPenney

A post published minutes ago on DarkForums claims a database breach of US retailer JCPenney. If verified, it exposes customer PII (names, emails, possibly payment data) that fuels credential stuffing and targeted phishing. Retail defenders should validate the sample, scope affected records and force password resets.

Base de datos de 369cinemas.ae con 12 millones de registros a la venta

369cinemas.ae

Seller Marx is offering a database of the UAE cinema site 369cinemas.ae with over 12 million records. The victim is outside Latin America, so regional impact is indirect, but it demonstrates the actor reselling large consumer datasets. Worth noting only as context for a higher-priority campaign.

Base de datos de Dubai Smart Travel con 12 millones de registros a la venta

Dubai Smart Travel

Seller Marx is offering a database of Dubai Smart Travel with over 12 million records. The victim is a UAE travel company, so direct LatAm impact is limited, but it is a large commercial dataset being resold. Useful for tracking this prolific actor's broader campaign across regions.

Base de datos de 41 millones de usuarios de inDrive a la venta

inDrive

Seller Marx is offering a database of inDrive containing over 41 million records. inDrive is a major ride-hailing platform across Latin America, so leaked user data could fuel phishing, account takeover and driver/rider fraud. The scale makes this a notable commercial leak worth monitoring in the region.

Datos de clientes de Fidelity y Synchrony a la venta (fullz + CC)

Fidelity / Synchrony

An actor is selling a 'dual ingest' of financial data attributed to Fidelity and Synchrony, combining fullz and live credit card records from a June 2026 pull. Although US-based and a few months old, pairing identity data with live cards fuels card-not-present fraud and account takeover. Relevant to financial-sector fraud and CTI teams.

Base de datos con 14,7 millones de ciudadanos argentinos a la venta

Ciudadanos de Argentina

A seller is offering a database of 14.7 million Argentine citizens plus about 600k additional records, posted today so likely fresh. Such identity data (names, IDs, contacts) enables phishing, fraud, account takeover and impersonation at national scale. Argentine defenders should treat it as an active exposure of citizen PII that maps directly to government and financial services.

Base de datos de PayPal con 14 millones de registros a la venta

PayPal

Seller Marx is listing a database attributed to PayPal with over 14 million records on DarkForums, dated 4 October 2026. PayPal is a very high-value target, but such posts often recycle old data, so authenticity is unconfirmed. It still warrants monitoring for financial fraud and credential re-use.

Filtración de la base de datos de Meetic disponible para descarga

Meetic

A claimed Meetic dating-platform database is being offered for free download on BreachForums. Such a leak would expose credentials, emails and personal details of millions of dating users in Europe. Defenders should validate scope and watch for credential stuffing and re-use.

Base de datos de MedGulf (Bahréin) con 490.000 registros a la venta

medgulf.com.bh

An actor on DarkForums (Marx) is selling a database tied to medgulf.com.bh with over 490,000 records, posted on 4 October 2026. MedGulf is a health insurer operating in the Gulf, so the leak likely exposes personal and medical data of policyholders. Healthcare and insurance defenders should verify authenticity and prepare notifications.

Venta de 1,67 millones de credenciales URL:LOG:PASS

A seller is offering a 'fresh, private, valid' dump of 1.67 million URL:LOG:PASS credentials, a format consistent with stealer or combolist output. Credential sets of this type enable credential stuffing and initial access against web portals and exposed logins. The origin and target scope are unverified, so treat it as a mass credential exposure rather than a confirmed breach.

Filtración de 2.500 registros de stealer de México (Windows 10)

A free dump of roughly 2,500 infostealer logs harvested from machines in Mexico running Windows 10 Enterprise was posted today. Such logs typically contain browser-saved credentials, cookies and live session tokens that enable account takeover and initial network access. For LATAM defenders this is a fresh, region-specific exposure that warrants credential resets and compromise hunting.

ShinyHunters publica base de datos ANTS de 13,1 millones

ShinyHunters posted a 13.1M-record database named 'ANTS' to BreachForums, a large dump from a known prolific group. The post dates from June 2026 and is not fresh, so it is not a new alert, but its scale makes credential reuse and follow-on attacks likely. Useful for tracking past exposure and credential hygiene.

Base de datos B2B de EE.UU. con 31M de registros a la venta

A seller is offering a US-focused B2B database of 31M+ business records labelled 'fresh 2026', likely containing company contacts and firmographic data. Such datasets directly fuel targeted BEC, phishing and lead-generation fraud. Organizations in the dataset should anticipate a rise in social-engineering attempts.

Filtración de base de datos y código fuente de smpw.net

smpw.net (Testigos de Jehová)

A threat actor is publishing a full database dump plus the underlying source code of smpw.net, a Jehovah's Witnesses platform, in a very recent post. Exposed data likely includes member accounts and personal details, enabling credential stuffing and phishing against a large, identifiable user base. Defenders should treat any reused credentials as compromised.

Base de datos de COVID de Brasil (2021-2023) republicada en un foro

A database labelled as Brazilian COVID data covering 2021-2023 is being re-posted in a darkweb marketplace. It concerns health-related personal data, a sensitive category under Brazil's LGPD, although the underlying records are several years old. Brazilian health authorities and partners should verify exposure and assess notification duties.

Filtración de 2.500 registros de infostealer de equipos Windows en México

An Aurora infostealer log pack covering roughly 2,500 compromised Windows 10 Enterprise machines in Mexico is being shared for free. Such logs typically contain browser credentials, cookies and session tokens that enable account takeover and lateral movement. Mexican organizations should hunt for exposed corporate credentials and reset affected accounts.

Venta de archivos sensibles de KPMG con muestra gratuita

KPMG

A threat actor is posting a free sample of allegedly sensitive internal KPMG documents to advertise a larger paid sale. KPMG is a global audit and consulting firm whose internal files can include confidential client and public-sector engagements. Client organizations and KPMG itself should watch for follow-on phishing, extortion or data-driven attacks.

Base de datos de 2 millones de números de Seguro Social de EE.UU. a la venta

A freshly posted DarkForums thread is sharing a database described as 2 million US citizen SSN records with additional personal details. SSNs and identity data enable large-scale synthetic-identity fraud, loan and tax fraud, and account takeover. US defenders and fraud teams should monitor for downstream credential and financial abuse.

Base de datos de 20 millones de ciudadanos españoles con datos financieros a la venta

A seller on DarkForums is advertising a 20-million-record database of Spanish citizens that reportedly includes financial data. Such a dataset fuels identity theft, targeted phishing with accurate personal details, and fraud against banking customers. Spanish banks and public bodies should treat it as a fresh PII and financial-exposure risk and prepare customer notifications.

Base de datos de Zynga filtrada y disponible para descarga

Zynga

A database attributed to gaming company Zynga is circulating for download, exposing player account and personal data. No post date is shown and it may overlap with earlier Zynga breaches, so confidence is low and it is not a fresh alert. Affected users still face credential-stuffing and phishing risk if the records are valid.

Filtración de base de datos de Drupal.org con 1,75 millones de registros

Drupal.org

A 1.75 million-line dump attributed to Drupal.org — including full names, email addresses and phone numbers — is being offered for download on the Spear Leaks forum. The data enables credential stuffing and targeted phishing against the Drupal developer and site-maintainer community. Defenders should monitor for reused passwords and phishing aimed at maintainer accounts.