Underground · what matters today

Base de datos de estudiantes rusos a la venta en DarkNetArmy

A database of Russian school students is being sold on the DarkNetArmy forum, exposing emails, full names, dates of birth, phone numbers, school, class and Skype IDs. It is a real PII leak enabling identity theft and targeted phishing against minors, though outside the AR-LATAM region. Analysts tracking education-sector exposure and re-used credentials should note it.

Brecha de datos en la empresa Mohammed Hadi Al-Rasheed

Mohammed Hadi Al-Rasheed Co

A threat actor posted a data breach claim against Mohammed Hadi Al-Rasheed Co on RaidForums/BreachForums today (13 Oct 2026), offering stolen records for distribution. The exact record count is unconfirmed, but a freshly published corporate database dump of this kind can enable fraud, credential stuffing and follow-on intrusion. It matters mainly as a timely leak to monitor, though the victim is outside the AR-LATAM focus.

Base de datos de Doublecounter.gg filtrada

Doublecounter.gg

The database of Doublecounter.gg, a Discord anti-fraud and verification service, has been posted for download. Exposed user and session data can undermine platform trust and enable account abuse. Mid-impact but relevant for fraud-adjacent defenders.

Base de 10 millones de propietarios de autos franceses a la venta

A 10-million-record database of French car owners is offered for sale, exposing names, addresses and vehicle data. It enables targeted fraud and impersonation in France. Non-LATAM, but a large European PII leak worth flagging.

Información de facturación de 6 millones de registros a la venta

A seller lists a 6-million-record billing/customer dataset for sale, exposing payment and personal billing details. Such data enables payment fraud and targeted phishing. Fraud teams should treat it as commodity but actionable PII.

Filtración de 26,2 millones de líneas de credenciales (12-OCT-2026)

A dump of roughly 26.2 million credential/stealer-log lines, dated 12 Oct 2026, was released free in 10 parts. Fresh credential material drives credential-stuffing and account takeover across many services. Defenders should detect reuse of leaked credentials and enforce MFA.

Base de 134 millones de propietarios de viviendas en EE.UU. a la venta

134 million U.S. home-owner records are advertised for sale, exposing names, addresses and property/loan details. This mass PII fuels mortgage fraud, impersonation and real-estate scams. It is not a single-org breach but a broad fraud and privacy risk.

Base fullz de 237 millones de registros de EE.UU. a la venta

A vendor is selling a 237-million-record 'fullz' dataset covering U.S. residents, likely including names, addresses and SSN/DOB data. Lists of this size fuel identity theft, synthetic fraud and account-opening abuse. Banks and identity-verification teams should expect a spike in fraudulent onboarding.

Base de datos del banco estadounidense Truist filtrada

Truist Bank

The full database of Truist, a major U.S. bank, has been posted for public download on BreachForums. Customer and account records of this scale enable account takeover, fraud and targeted phishing against the bank's clients. Financial defenders should assume the data is now in criminal hands.

Datos del Departamento de Comercio de EE.UU. a la venta

U.S. Department of Commerce

A seller is offering a dataset tied to the U.S. Department of Commerce in a darkweb leaks market, an unusually high-value government target. Compromise of federal-agency data can expose internal contacts and systems. Defenders should watch for downstream phishing and impersonation.

Filtración de datos financieros de Polish Falcons of America

Polish Falcons of America (PFA)

A leak of financial records belonging to the Polish Falcons of America (PFA), a US fraternal benefit society, is being shared on the Niflheim forum. PFA administers insurance and annuity products for its members, so exposed financial data could fuel fraud and account takeover against policyholders. It is outside the AR-LATAM/critical-infrastructure focus, but it is a genuine named-organization leak worth tracking.

Combolist masivo de credenciales argentinas publicado (junio 2025)

A high-volume combolist of Argentine credentials (email/username and password) was shared on a leak forum, but the thread dates to June 2025 and is stale rather than a fresh alert. It remains useful only as historical exposure for checking long-lived password reuse. It should not be treated as a time-sensitive notification.

Combolist de 124.000 credenciales argentinas publicado en foro

A forum actor posted a freshly uploaded combolist of roughly 124,000 Argentine email/URL and password pairs for credential-stuffing. It is not tied to a single named organization, but it directly enables account-takeover and fraud against Argentine services and users. Defenders should check password reuse and enforce MFA on any exposed accounts in the set.

Filtración de datos financieros de Polish Falcons of America

Polish Falcons of America (PFA)

A financial data leak attributed to Polish Falcons of America (PFA) has been posted on DarkNetArmy. The material appears to relate to the fraternal organization's accounts or member financial records. Exposure of financial data elevates fraud and regulatory risk for the organization.

Filtración de base de datos de la Universidad de Camarines Norte

University of Camarines Norte

A database belonging to the University of Camarines Norte in the Philippines is being offered on DarkForums. University records typically contain student and staff PII such as names, IDs and contact data, enabling targeted phishing and identity fraud. Affected institutions should verify the breach and notify users.

Filtración de 25 millones de cuentas de VK.com

VK.com

A 25-million-record dataset attributed to VK.com, a major Russian social network, is being circulated on DarkForums. If genuine and current, it enables large-scale credential stuffing and account takeover against VK users and any service where passwords were reused. Defenders should force password resets and watch for credential-reuse attacks.

Combolist de 430.000 credenciales de Brasil (marzo 2026)

Brasil (usuarios/servicios)

A 430K+ Brazil-focused email:password combolist dated March 2026 is circulating. Because it predates today by months it is not a fresh alert, but it can still fuel credential-stuffing against Brazilian services and users. Low urgency, mostly historic exposure.

Filtración de vigilancia del aeropuerto de Shanghái (Suishenma)

Shanghai Suishenma / vigilancia aeroportuaria

A threat actor claims to have obtained surveillance-related data tied to Shanghai's Suishenma platform connected to airport monitoring. Exposure of physical-security or biometric data at a major transport hub enables profiling, stalking and abuse of government surveillance infrastructure. Relevant for analysts tracking gov-adjacent infrastructure leaks.

Venta de licencias de conducir mexicanas válidas

México (licencias de conducir)

A vendor is advertising nationally valid Mexican driver's licenses, suggesting either abuse of genuine government issuance or high-quality forgeries. Such documents fuel identity fraud, account takeover and bypass of KYC, age and identity checks across Mexico. Relevant for LATAM defenders tracking identity-document abuse.

Combolist de 325.000 credenciales de correo de Brasil

Brasil (usuarios de correo)

A DarkForums leak thread advertises a freshly checked combolist of roughly 325,000 Brazilian email:password pairs. Such credentials fuel credential-stuffing and account-takeover against Brazilian users and services. It is only a mid-sized combolist, so impact is limited, but regionally relevant for tracking credential re-use.

Base de datos de 7,4 millones de ciudadanos de Paraguay a la venta

Paraguay (ciudadanos)

A dark-web post offers a database allegedly containing data on 7.4 million Paraguayan citizens, close to the country's entire population. This implies national-ID, personal and possibly electoral records at massive scale, highly sensitive for identity theft. However, the post is dated May 2025, so it is not a fresh alert; verify validity and any renewed redistribution.

Filtración de datos personales del Registro Electoral de Argentina (2013)

Registro Electoral de Argentina

11 million records of Argentine personal data from the 2013 Electoral Registry are being reposted. The data is over a decade old, so it is largely stale, but it still contains names, DNI, and addresses useful for identity fraud. It is not a fresh incident and merits only background awareness.

Base de datos con 820 millones de usuarios de Alipay a la venta

Alipay

A seller claims to hold a full database of 820 million Alipay users, China's dominant payment platform. If authentic it would be one of the largest fintech leaks, though such claims are frequently recycled or inflated. Financial and identity data at this scale fuels fraud and account takeover.

Filtración de base de datos de Crunchbase

Crunchbase

A database attributed to Crunchbase, the corporate and startup intelligence platform, is being shared. Such data exposes business contacts, investor and company profiles across many organizations. It is valuable for targeted B2B phishing and social engineering.