Underground · what matters today

Filtración de 1,1 millones de registros robados (ULP)

User EvenRoad posted a fresh pack of roughly 1.1 million stolen credential logs (ULP: URL, login, password) on DarkForums. While it names no specific victim, the volume is significant for credential-stuffing and account-takeover campaigns. It is a fresh dump worth ingesting for exposure monitoring rather than a targeted alert.

Datos filtrados del Pentágono publicados en un foro

Pentagon / US DoD

A DarkForums post titled 'Pentagon Leaked Data' claims to expose sensitive material tied to the US Department of Defense. If genuine it would be a major military data exposure; however the listing gives no sample, scale or date, so it may be recycled or fake. Analysts should verify authenticity before acting, but the claim warrants monitoring.

Registros de 9.000 equipos infectados con RAT a la venta

A seller lists RAT logs from more than 9,000 infected PCs, dated to mid-January, exposing credentials and session cookies. The dataset is stale but signals widespread malware infections. Low priority for fresh alerting, yet relevant for credential-exposure monitoring.

Datos personales de 20.000 estudiantes de Taiwán a la venta

Assota Information

Roughly 20,000 student records linked to Assota Information in Taiwan are being sold on BreachForums, including names and contact details. Student data fuels targeted phishing and identity fraud against minors and institutions. The scale is moderate but the victim is a real education-sector entity.

Filtración masiva de 1.688 millones de credenciales robadas

A forum is distributing a huge stealer-log collection of roughly 1,688 million URL:login:password entries. Although dated July 2026 it remains a massive credential corpus that fuels credential stuffing and account takeover at scale. Organizations should enforce MFA and monitor for reused passwords.

Base de datos de clientes VIP de Pathao a la venta

Pathao

A threat actor is selling detailed VIP customer records from Pathao, a major Bangladeshi ride-hailing and delivery platform. Such data typically includes names, phone numbers, addresses and order history, enabling phishing and fraud. Defenders should flag credential-stuffing and impersonation risks for affected users.

Venta de datos de pacientes del East Avenue Medical Center

East Avenue Medical Center

Threat actor Blacknet00 is advertising patient data stolen from East Avenue Medical Center, a public hospital in the Philippines. Sale of medical records exposes sensitive health and identity data of patients and enables fraud and targeted extortion. Posted on 12 Oct 2026, it is recent; healthcare defenders should treat it as a live data-breach listing.

Combolist de 90.000 credenciales de correo de México

Mexican email accounts

A combolist of roughly 90,000 email:password pairs tagged to Mexico was released as 'fresh' on October 14. It fuels credential-stuffing and account-takeover against Mexican mailboxes and linked services. It is a generic regional credential set rather than critical-infrastructure compromise, but defenders in Mexico should force resets and watch authentication anomalies.

Combolist de 24 millones de credenciales URL:email:pass

A large credential dump of roughly 24 million URL:email:password triples has been posted as 'fresh', though it is months old. This stealer-log volume enables mass credential-stuffing and session hijacking across many services. Organizations should check their domains against the set and enforce MFA, but it is generic data rather than a targeted breach.

Filtración de datos sensibles del DRDO y militares de India

DRDO / Indian military

A leak forum claims highly sensitive data from India's Defence Research and Development Organisation (DRDO) and military has been exposed. Such material can reveal defence projects, personnel and technical details valuable to state and non-state actors. Although it lies outside Latin America, regional defence and intelligence teams should track it as a precedent for military-sector exposure.

Filtración de la base de datos de clientes de Salesfloor

Salesfloor

The Salesfloor database has been posted for free download on a major breach forum, with long-running discussion indicating a large multi-page release. Salesfloor supplies retail clienteling software, so the data may include customer records and contacts tied to multiple retail brands. Affected retailers and their customers should treat credentials and PII as compromised.

Base de datos de inversores bursátiles de EE. UU. a la venta

US brokerage / stock investors

A seller is offering a claimed direct dump of US stock-investor records pulled from major brokerage systems. If genuine, it exposes investor PII and financial account data usable for account takeover, identity theft and targeted fraud. Brokerages and wealth managers should verify exposure and monitor for credential-stuffing and account-takeover attempts.

Base de datos de ciudadanos de Polonia a la venta

Base de datos de ciudadanos de Polonia

A seller is offering a 'Poland Citizen Database', a potentially high-impact national citizen dataset posted just recently. If authentic, it exposes personal identifiers enabling identity theft, fraud and account takeover. Given the scale implied, it warrants verification and monitoring.

Filtración masiva de datos de Taiwán (3,46 GB)

A 3.46 GB dataset advertised as a large Taiwan data leak was posted yesterday, suggesting a sizable compromise of Taiwanese data. The exact content is unverified, but the volume implies records that could fuel fraud and credential attacks. Analysts should acquire and validate the sample before acting.

Base de datos de declaraciones fiscales cripto de Francia en venta

Declaraciones fiscales de cripto (Francia)

A listing offers a database of cryptocurrency tax filings from France, corresponding to sensitive government tax data on French crypto holders. Exposure of filers' identities and financial data enables targeted fraud, extortion and phishing. Authorities and affected taxpayers should treat it as a serious privacy and compliance breach.

Base de datos de Zoho CRM con 237 millones de registros en venta

Zoho CRM

A forum seller is offering a 237 million-record Zoho CRM dataset, a very large trove of accounts and contact details. If genuine, it enables credential stuffing, phishing and account takeover at scale for organizations using Zoho. Defenders should check for Zoho credential exposure and enforce MFA.

Base de datos de hdsoudage.fr (Francia) de 50.000 registros a la venta

hdsoudage.fr

A seller is offering a 50,000-record database from the French site hdsoudage.fr. It is small and several months old, so impact is limited and it is not a fresh alert. It still confirms ongoing retail-data sales but warrants only low priority.

Filtración de pasaportes y facturación de Iraqi Airways

Iraqi Airways

A seller advertises passport and billing data from Iraqi Airways for sale, exposing identity documents and payment records of travelers. Exposed passport and billing data fuel identity theft, travel fraud and targeted phishing. Regional relevance is low, but it is a genuine airline data leak worth tracking.

Filtración de documentos de drones militares UAV de Corea del Sur

Fuerzas militares de Corea del Sur

3.8 GB of South Korean military UAV drone documentation was published, exposing technical specifications and operational details of a state defense program. Leaked military drone data is highly sensitive and can aid adversaries and proliferators. It is outside LatAm but signals active targeting of defense drone programs that regional militaries also operate.

Base de datos de clientes y banca móvil del BNI de Indonesia a la venta

Bank Negara Indonesia (BNI)

The complete customer database and mobile-banking data of Bank Negara Indonesia (BNI), a major state-owned bank, is offered for sale. Exposed records cover millions of customers and include banking and account data that fuel fraud and account takeover. It is outside LatAm but evidences a live, high-volume banking-data sale relevant to regional financial defenders.

Base de datos de 2 millones de líneas de helity.es España a la venta

helity.es

A seller is offering a 2 million-record database tied to Spanish telecom helity.es, including DNI identity numbers. Exposed names, DNI and contact data enable identity theft, phishing and SIM-swap fraud against real people. DNI-linked records are especially sensitive in Spain and across LatAm and warrant a takedown and victim-notification effort.

Filtración del código fuente de Yandex en repositorios Git

Yandex

A thread posted within the last hours offers what is described as Yandex Git source code repositories. If genuine, leaked proprietary source lets attackers hunt for hardcoded secrets, internal endpoints and unpatched flaws across Yandex services and downstream integrations. Source-code exposure of a major technology and infrastructure provider is high-value for defenders to monitor.

Filtración de datos de la policía de Abu Dabi y Dubái

Abu Dhabi & Dubai Police (UAE)

A forum user published on 13 October 2026 what is claimed to be data belonging to the Abu Dhabi and Dubai police forces. Law-enforcement records of this type can expose officer identities, internal contacts and operational details that enable phishing and impersonation. It is a named government victim with a fresh dump, so it warrants tracking even though it sits outside the AR-LATAM region.

Filtración masiva de Diia (Ucrania): 20 M ciudadanos

Diia (Ucrania)

A thread re-shares a claimed 2025 mega leak of Ukraine's Diia state digital-identity platform affecting 20M+ citizens. The data involves national identity documents and personal records, making it highly sensitive, but the source is dated 2025 and is being recirculated rather than freshly breached. It is catalogued for context, not as a time-sensitive alert.