Underground · what matters today

Paquete de filtraciones de bases de datos de criptomonedas a la venta

A bundle of leaked cryptocurrency databases totaling around 21.2 million records is being sold. Posted in March 2026, it is stale and likely an aggregation, so it is not a fresh alert. It remains marginally useful for tracking credential and account exposure in the crypto sector.

Base de datos de 600 millones de registros de EE. UU. en venta

A collection of roughly 600 million US records containing names, SSNs, addresses and related people is being offered, an unusually large identity dataset. Although US-focused, it fuels identity theft, account takeover and fraud at scale. Defenders should treat the SSN and address exposure as high-risk for financial abuse.

Base de datos de 100.000 consumidores de Sudáfrica a la venta

A seller is offering a database containing information on roughly 100,000 consumers from South Africa. Bulk consumer PII of this scale fuels credential stuffing, phishing and identity fraud. The date is unknown, so verify authenticity before treating it as fresh.

Brecha en el archivo interno del registro civil de Bandung

disdukcapil.bandung.go.id

An actor claims to have breached the internal archive of the Bandung civil registry (disdukcapil.bandung.go.id), exposing citizen records held by a local government agency. Government identity databases enable large-scale fraud and are sensitive even outside our region. The post looks dated around late July, so it is not a fresh alert.

Filtración de datos de solicitantes de la oficina de trabajo de Pekalongan (Indonesia)

Pekalongan Regency Manpower Office

A freshly posted dump claims data from the Pekalongan Regency Manpower Office job-applicant database in Indonesia. It is a government dataset likely containing national IDs and PII, but it is outside the Argentina/LatAm scope and the contents are unverified. Track only as regional context unless linked to local actors.

Filtración de base de datos de Goldston Oil Corporation (EE. UU.)

Goldston Oil Corporation

A user posted a database bundle attributed to US energy firm Goldston Oil Corporation on DarkForums only minutes before collection. The size and fields are unverified, but energy-sector dumps typically carry employee PII and internal contacts useful for phishing and fraud. Defenders in oil/gas should confirm exposure and watch for credential reuse.

Venta de datos de tres empresas contratistas de Aramco

Contratistas de Saudi Aramco

A seller offers data allegedly taken from three contracting companies working for Saudi Aramco. Supplier and contractor databases often contain employee PII, project details and credentials useful for follow-on intrusion. It highlights supply-chain risk around a high-value energy target, though outside the AR-LATAM region.

Base de datos de mrkaka.com (77K) a la venta en India

mrkaka.com

A seller advertises the mrkaka.com database of about 77,000 records from India. The leaked user data can fuel phishing and account-takeover campaigns against the service's userbase. Impact is limited to this Indian service and its customers and is of little regional relevance.

Base de datos de gokart-profi.de (60K) a la venta

gokart-profi.de

A seller is offering the gokart-profi.de database of roughly 60,000 records from a German karting/e-commerce site. The exposed customer PII and credentials enable phishing and account takeover against its shoppers. This is relevant mainly to the affected merchant and its German customers, not to AR-LATAM interests.

Base de datos de truthbook.social (75K) a la venta

truthbook.social

A 75,000-record database from the truthbook.social network is listed for sale, containing user account data such as emails, passwords and profile details. It exposes members to credential-stuffing and impersonation attacks. Impact is confined to the platform's userbase rather than any regional critical infrastructure.

Filtración de base de datos del ERP SPIDIT (JJTS): 57K envíos

SPIDIT ERP / JJTS

A full dump of the SPIDIT ERP / JJTS platform is being advertised, with roughly 57,000 shipment records and 26,000 email addresses plus plaintext credentials. Because it bundles logistics data with cleartext logins, it enables account takeover and supply-chain reconnaissance against anyone using or integrated with this ERP. Defenders should force credential resets and audit access to this system.

Filtración de la base de datos de SalonBiz

SalonBiz

A forum post claims a data breach of SalonBiz, a salon-management software vendor, with the stolen database offered for download. Because SalonBiz serves many businesses, a single compromise can expose customer records for numerous downstream clients. This is a straightforward real-organization breach worth cataloguing for supply-chain impact.

Base de datos de 108 millones de números de teléfono a la venta

A seller is offering a database of roughly 108 million phone numbers, a large contact dataset for sale on a criminal forum. Bulk phone data fuels smishing, spam and account-takeover campaigns and enables targeted social engineering. While no single organization is named, the scale warrants tracking for downstream fraud exposure.

Filtración de datos de pasarela de pago Geidea (Arabia Saudí)

Geidea

A payment-gateway dataset (Gideon vs Geidea, Saudi Arabia) has been posted. Payment-gateway data typically includes transaction and cardholder information, raising card-fraud and PCI implications. Verify scope and check whether card or PII data is included, and monitor for related fraud.

Base de datos del partido AK de Turquía filtrada

Turkey AK Party

A database attributed to Turkey's ruling AK Party has been posted. Political-party leaks can expose members and voter information, raising privacy and influence-operation concerns. Verify authenticity and scale, and watch for reuse in disinformation or targeted harassment.

Publicación de 384 volcados SQL (31 GB) de múltiples organizaciones

A 31 GB archive of 384 SQL dumps attributed to multiple organizations has been posted. Bulk dumps like this often aggregate many victim databases and are resold widely, increasing abuse potential. Analysts should triage the archive for any Latin American or government entities.

Filtración de 82 millones de direcciones de Yuantong Express (China)

Yuantong Express (yto.net.cn)

82 million addresses attributed to Chinese courier Yuantong Express (yto.net.cn) have been leaked. This is a very large PII set of names, addresses and phone numbers that enables targeted fraud and phishing. Track it for downstream abuse and identity-theft campaigns and cross-check subscribers of interest.

Filtración de la base de datos del Banco Nacional de Pakistán

National Bank of Pakistan

A database from the National Bank of Pakistan has been posted for download. Banking data leaks expose account holders to fraud and the institution to regulatory and financial risk. Verify the record count and whether customer PII or authentication data is included.

Filtración de datos de Boeing.com

Boeing

A dataset attributed to Boeing.com has been posted for download. Boeing is a major aerospace and defence contractor, so any authentic exposure of employee, supplier or internal data carries counter-intelligence and supply-chain risk. Analysts should verify the sample and check for credential reuse or sensitive internal documents.

ShinyHunters filtra la base de datos de Sysco

Sysco

ShinyHunters published a data leak attributed to sysco.com, the large US wholesale food distributor, on a leak forum. As a major supply-chain player, exposed corporate records could enable business-email-compromise and downstream supplier fraud. It is region-external, so mainly relevant for tracking the group's activity and any LATAM-linked partners.

ShinyHunters filtra la base de datos de Madison Square Garden Sports

Madison Square Garden Sports (MSGS)

ShinyHunters posted a database dump attributed to msgsports.com, the Madison Square Garden Sports corporation, on a leak forum. It is a real-organization data leak from a known extortion group, exposing corporate or customer records that could feed fraud and targeted phishing. Not region-specific, so lower priority for AR-LATAM defenders but worth tracking for the actor's targeting pattern.

ShinyHunters filtra datos analíticos de Rockstar Games

Rockstar Games

The ShinyHunters crew published a fresh leak of internal analytics data belonging to Rockstar Games, posted to a clearnet leak forum within the last hours. It is a newly dropped dump from a prolific and active ransomware/extortion group, so defenders tracking ShinyHunters should assess brand, employee and partner exposure. The recency makes it operationally relevant for monitoring follow-on extortion or phishing.

Presuntos datos de participantes de Interpol ofrecidos en foro

Interpol

A forum user claims to hold data on Interpol participants, posted minutes before collection. If genuine, this could expose law-enforcement contacts across many countries, including Latin America. No sample or record count is shown, so treat as an unverified but potentially sensitive claim worth monitoring.

Shinyhunters filtra datos analíticos de Rockstar Games

Rockstar Games

The Shinyhunters group has published internal analytics data stolen from Rockstar Games, a major global publisher. Exposure of analytics datasets can reveal user behavior, product metrics and partner data, aiding follow-on social engineering and extortion. Although outside the AR-LATAM region, it is a fresh, high-profile corporate leak worth monitoring for TTPs and reposting risk.