Underground · what matters today

Filtración de la base de datos del sitio español airedefiesta.es

airedefiesta.es

A full database from the Spanish site airedefiesta.es is posted for sharing. It likely contains user accounts and personal data of Spanish residents, useful for credential stuffing and phishing. Defenders in Spain should alert affected users and force password resets.

Filtración de pedidos de la billetera de criptomonedas BitBox (Suiza)

Bitbox.swiss

Order data from BitBox, a Swiss hardware crypto wallet vendor, is being shared. Customer order records expose buyer identities, shipping addresses, and purchase details of high-value crypto holders. This is prime targeting material for phishing and physical-attack risk against wallet owners.

Filtración de 2,2 GB de la base de datos de stita.ac.id

stita.ac.id

A 2.2GB database covering the 2023-2025 period for the institution stita.ac.id has been leaked, exposing student, staff and academic records. Although the post is recent, the data spans several years, so credentials may already be reused elsewhere. Educational institutions are frequent fraud and phishing targets, making this useful for regional monitoring.

Filtración de la base de datos del Departamento de Vida Silvestre de Virginia

Virginia Department of Wildlife Resources

A database attributed to the Virginia Department of Wildlife Resources is being offered for public download, exposing state-agency records such as licence holders and staff. Government data leaks enable targeted phishing and identity fraud against the public and employees alike. Even outside LATAM it merits flagging for credential-reuse and vendor-supply-chain checks.

Filtración de 75 GB de la base de datos de JPM Group

JPM Group (jpmgroup.co.in)

A 75GB database attributed to JPM Group (jpmgroup.co.in) was posted for leak, indicating a large-scale exposure of corporate data. The volume suggests customer, employee and business records that are prime material for fraud, phishing and credential-stuffing. Analysts covering supply-chain risk should review the sample and notify affected partners.

Base de datos de Manchester Airports Group (MAG) a la venta

Manchester Airports Group (MAG)

A seller is offering a 2026 database belonging to Manchester Airports Group (MAG), operator of Manchester, Stansted and East Midlands airports. Exposure of passenger, staff or operational data at a major airport operator is a critical-infrastructure concern that can fuel fraud, phishing and follow-on intrusions. Treat the data as circulating and monitor for credential reuse and targeted campaigns against aviation staff.

Filtración de base de datos del Departamento de Vida Silvestre de Virginia

Virginia Department of Wildlife Resources

A leaked database of the Virginia Department of Wildlife Resources is offered for download on a dark web forum. State agencies of this kind hold licensing records, hunter and boater PII and staff contacts, exposing employees and residents to phishing and identity fraud. Though outside Latin America, a government-agency leak of this kind warrants verification and monitoring.

Filtración de datos internos de Uber con más de 20 millones de registros

Uber (uberhub.uberinternal.com)

A dataset reportedly from uberhub.uberinternal.com and Uber MDM with over 20 million records is offered. Internal corporate data of this size can expose employee credentials, device-management details and internal systems. It is a serious leak that defenders should monitor for reuse in downstream attacks.

Filtración de 25 millones de cuentas de VK.com

VK.com

A leak of 25 million VK.com accounts is being shared. Credentials from a major social network feed credential-stuffing against email and other services where users reuse passwords. Large combolists like this raise account-takeover risk for many downstream organizations.

Base de datos de documentos cripto rusos en venta

A database of Russian crypto-related documents is offered for sale. Identity and KYC documents tied to crypto users enable account takeover, extortion and fraud, and may include passport scans. Useful to track even if the exact organization behind it is unclear.

Filtración de 320.000 registros del Ayuntamiento de París

Mairie de Paris

A 320,000-record dataset attributed to the Mairie de Paris (Paris City Hall) is being shared. Municipal records can contain resident, tax and contact data, exposing citizens to targeted fraud and phishing. Government-held citizen data makes this a relevant public-sector breach.

Filtración de la base de datos de la farmacéutica Aurobindo

Aurobindo (aurobindo.com)

A database from Aurobindo, a major Indian pharmaceutical manufacturer, is offered for sale. Pharma data can include employee, partner and internal operational records valuable for fraud, phishing and competitive intelligence. Large corporate leaks like this often resurface in credential-stuffing campaigns.

Filtración de la base de datos nacional de ciudadanía de Pakistán

Base de datos nacional de ciudadanía de Pakistán

A thread advertises the Pakistan national citizenship database for download, a highly sensitive set covering identity records of an entire country. Such records fuel identity fraud, SIM-swap and account takeover at scale across public and financial services. Even outside LatAm this is a top-tier government leak worth tracking.

Filtración de la base de datos del sitio español airedefiesta.es

airedefiesta.es

A database belonging to the Spanish events/social site airedefiesta.es is offered on a forum. Although the site is small, the leak exposes user emails and likely hashed passwords that can be reused in phishing against Spanish-speaking victims. Monitor for credential reuse and notify affected users if verified.

Base de datos filtrada de MSI publicada en un foro

MSI

A database attributed to MSI is advertised on a criminal forum, potentially exposing corporate or customer records tied to the hardware vendor. If genuine, the data can fuel business email compromise, supplier fraud and credential abuse across partners. Defenders should confirm authenticity and scope before alerting affected units.

Filtración de la base de datos del banco FCI

FCI Bank

An actor claims to have leaked the database of FCI Bank, offering customer records to forum members. Financial databases of this type enable account takeover, fraudulent transfers and targeted phishing against the bank's clients. Security teams should verify the leak, assess scope and prepare customer notifications.

Filtración de la base de datos del National Bank of Pakistan

National Bank of Pakistan

A leak attributed to the National Bank of Pakistan is being published on a forum, exposing customer records of one of Pakistan's largest state-owned banks. Banking data of this scale drives fraud, account takeover and downstream phishing against account holders. Defenders and fraud teams should watch for card/account abuse and credential reuse.

Filtración de la base de datos de Evite.com con 36 millones de registros

Evite.com

A database of US event-invitation platform Evite with roughly 36 million records is being offered on a cybercrime forum. Exposed fields likely include names, emails and event details of millions of users, enabling phishing and credential-stuffing at scale. Defenders should flag Evite-linked credentials for reuse and warn downstream users.

Base de datos de la Federación Francesa de Rugby (ffr.fr) filtrada

Fédération Française de Rugby (ffr.fr)

A database belonging to the French Rugby Federation (ffr.fr) is advertised, likely exposing member and licensing data. Sports federations hold personal member data useful for fraud and phishing. Lower priority for LATAM defenders but relevant as an organization-level leak.

Filtración de base de datos de la Universidad Sharif de Tecnología (Irán)

Sharif University of Technology (Iran)

A database attributed to Iran's Sharif University of Technology is offered publicly, exposing academic and student records. University leaks enable phishing against students and staff and can expose sensitive research. Not in-region, but part of a broader pattern of targeting higher-education institutions.

Presunta filtración de datos de 182 millones de usuarios de Telegram

Telegram

A listing advertises a claimed 182 million-record Telegram user dataset alongside additional files. Mass messaging-platform data enables large-scale phishing, account enumeration and OTP/SIM abuse. Much of this may be recycled, but the scale warrants monitoring for reuse in credential attacks.

Presunta filtración de base de datos de empleados de YouTube

YouTube (Google)

A post claims an employee database for YouTube has been leaked, potentially exposing staff identity and corporate data of a major platform. If genuine, employee records fuel targeted phishing and account takeover against a high-value internet company. Verify before treating as confirmed, but monitor for downstream credential abuse.

Base de datos de la corredora AvaTrade España a la venta

AvaTrade (Spain)

A database attributed to the Spanish broker AvaTrade is offered for sale, likely containing client names, emails and account data. Financial-sector client records enable fraud, targeted phishing and identity theft against investors. Spanish and LATAM financial customers should be alerted and monitored for account takeover.

Filtración de datos internos de Uber (uberhub) con más de 20 millones de registros

Uber (uberhub.uberinternal.com)

A seller is circulating what appears to be internal Uber data associated with uberhub.uberinternal.com and MDM, claiming over 20 million records. If authentic, it exposes corporate identity, device-management and employee data useful for phishing and internal access. Uber is a high-profile target and such data can seed credential-stuffing and social engineering against its staff.