Underground · what matters today

Base de datos de ciudadanos belgas a la venta

Belgium (citizens)

A seller on BreachForums is advertising a database of Belgian citizen data for sale, indicating a possible national-scale personal data leak. If authentic, it would expose identity, contact and possibly registry details of Belgian residents, enabling identity fraud and targeted phishing. It falls outside the AR-LATAM region but is a genuine citizen-data sale worth verifying and tracking for downstream reuse.

Filtración de base de datos de SOS Villages (TF1 Info), 260.000 registros

sosvillages.tf1info.fr

A 260,000-record database from the French site sosvillages.tf1info.fr was posted on RaidForums (Aug 2026). Such datasets typically contain personal data used for phishing and fraud. It is a real-organization leak, though not tied to Latin American critical infrastructure.

Filtración de base de datos de la Universidad de Pensilvania

University of Pennsylvania

A database described as belonging to the University of Pennsylvania was posted for free download. University leaks expose student, staff and research data that fuels phishing and identity theft. It is a real-organization leak, though outside the region and of unclear freshness.

Brecha de base de datos de cajeros automáticos en Turquía (ATMPoint)

A threat actor posted a database allegedly from a Turkish ATM network (ATMPoint). ATM-related data can include card, transaction and consumer records enabling financial fraud and card cloning. It is fresh and financially sensitive, warranting monitoring even outside the region.

Base de datos del gobierno de Irak (rss.gov.iq) filtrada, 100 GB

rss.gov.iq (Irak)

A 100 GB database belonging to Iraq's rss.gov.iq was posted as leaked (Aug 2026). Government datasets of this size typically hold citizen records, credentials and internal documents useful for fraud and espionage. Though not in Latin America, it signals a serious government breach worth tracking.

Filtración de base de datos de la Fiscalía General de la República de México

Fiscalía General de la República (México)

A user posted a database attributed to Mexico's Fiscalía General de la República (FGR), the federal prosecution service. If genuine it could expose case files, personnel and citizen data enabling fraud and follow-on intrusions. A high-value LATAM government target that should be verified immediately.

Base de datos de clientes de iFood Brasil a la venta

iFood (Brasil)

A DarkForums seller is offering an iFood Brazil customer database for sale. iFood is one of Latin America's largest food-delivery platforms, so stolen records enable phishing, account takeover and consumer fraud. Regional fraud-defense and anti-abuse teams should watch for credential-stuffing and identity-theft campaigns.

Filtración de 275.000 registros de la plataforma Double Counter

Double Counter

A forum post advertises a 2026 leak of the Double Counter database containing roughly 275,000 records of Discord usernames and emails. Double Counter is a Discord verification service, so the data may tie accounts to email addresses used across many communities. It is a mid-size credential and PII exposure useful for targeted phishing, though limited in sectoral impact.

Base de datos de la fintech bangladesí Pathao publicada en un foro

Pathao

A threat actor published a database allegedly tied to Pathao, a major Bangladeshi ride-hailing and digital-payments firm, on a hacking forum. The dump's exact volume and fields are unverified, but such data typically includes user accounts and contact details. If authentic, it could fuel credential stuffing, fraud and account takeover across Pathao's large regional user base.

A la venta base de datos de 1.200 millones de registros atribuida a AT&T

AT&T

A freshly posted thread offers a database labeled as 1.2 billion records belonging to AT&T, the major US telecommunications carrier. The scale and telecom nature make it a high-value trove for SIM-swap, phishing and account-takeover campaigns if the data is genuine. Note that similar AT&T datasets have circulated before, so the dump may be recycled rather than new.

Venta de expedientes VIP de clientes de Pathao (Bangladesh)

Pathao

A seller advertises 'Pathao VIP Dossiers' with proof of access, referring to the major South Asian ride-hailing and fintech platform. This points to a real breach of passenger or customer records rather than marketing noise. It matters for fintech fraud and identity-theft monitoring across the region.

Base de datos de 88 millones de registros de EE. UU. a la venta

A forum user posted today a 'full info' database of 88 million US records in the premium section. The scale and same-day recency point to a fresh, monetizable dump rather than recycled data. US defenders should check whether their user or customer data is included and monitor for resale.

Filtración de base de datos del servicio Double Counter

Double Counter

A fresh database leak titled 'Double Counter leak' was posted on DarkForums by a staff account, targeting the Double Counter Discord verification bot. Details of scale and data fields are not yet visible, and the affected service is not government or critical infrastructure. It is worth only peripheral tracking for Discord-community exposure.

Filtración de 92.000 registros de Yale University Press

Yale University Press (yalebooks.yale.edu)

A 92,000-record database belonging to Yale University Press (yalebooks.yale.edu) has been posted on BreachForums with a public download link. It exposes the personal and likely credential data of the press's customer base. Although outside the AR-LATAM region, it is a named real organization and useful for credential-stuffing and phishing monitoring against educational-sector accounts.

Volcado de registros de 10,3 GB de White Cloud (9 de octubre)

A fresh 10.3 GB stealer-log dump labelled 'White Cloud' was posted on Oct 9, containing large volumes of credential and session data from victim machines. While no single named organization is identified, the size means corporate and government credentials are likely mixed in. Defenders should feed these logs into credential-monitoring to catch reused passwords.

Filtración de datos de apuestas de Bahigo (Turquía)

Bahigo.com

A newly posted thread (about 47 minutes old) shares customer and betting data from Turkish betting site Bahigo.com. Such datasets carry PII and payment/identity details that are directly usable for account takeover and fraud. Regional iGaming, payment-fraud and abuse teams should flag the exposed accounts for monitoring and forced resets.

Filtración de base de datos de apuestas de Elexbet (Turquía)

Elexbet.com

A fresh post (about 49 minutes old) offers the customer/betting database of Turkish bookmaker Elexbet.com. Betting dumps typically contain names, emails, phone numbers and identity/payment data, which fuel fraud, KYC bypass and credential-stuffing. Fraud and iGaming defenders should treat the affected accounts and shared credentials as compromised.

Venta de base de datos de Korea Telecom (13 millones de registros)

Korea Telecom

A vendor on DarkForums is selling a 13-million-record dataset attributed to Korea Telecom, one of South Korea's largest carriers and part of critical national infrastructure. If genuine, it exposes subscriber PII at scale, enabling SIM-swap, phishing and account-takeover campaigns against millions of users. Telecom data also creates downstream risk for enterprise and government customers that rely on the operator.

Venta de 3,8 M de registros inmobiliarios (IAD Group) en la UE

IAD Group

A 3.8 million record, 966 GB dataset attributed to European real-estate network IAD Group is being sold. Large property/customer datasets support targeted phishing and fraud against agents and clients. It is a sizeable commercial leak, though not in Latin America.

Venta de 2,2 M de registros de clientes de CITYA Immobilier (Francia)

CITYA Immobilier

A seller is offering 2.2 million records from French real-estate firm CITYA Immobilier plus 50K digital codes. The scale and inclusion of access codes make it a relevant commercial data leak enabling fraud and account abuse. It matters for partners and customers in the EU.

Base de datos fiscales de California a la venta

California tax data (californiataxdata.com)

A seller is offering U.S. California tax data tied to californiataxdata.com, a sensitive trove of personal and financial records. Tax data fuels identity theft, fraudulent filings and account takeover against many individuals. Worth checking entity scope and whether records are fresh.

Base de datos de clientes de Zain Telecom Irak a la venta

Zain Telecom Iraq

A customer database of Zain Telecom Iraq is being offered for sale, posted today (12 Oct 2026). Telecom subscriber records enable SIM-swap, phishing and account-takeover campaigns against a very large user base. Operators in the region should confirm scope and warn affected customers quickly.

Filtración de 2,9 TB de documentos confidenciales de Colombia

Colombia (documentos confidenciales)

A post published minutes ago offers a 2.9 TB archive of confidential Colombian documents, implying government or critical-sector data rather than a plain credential dump. The volume and the 'confidential' label make it a priority to verify against Colombian public-sector and critical-infrastructure victims. Defenders should treat it as an active, high-impact exposure.

Dump del SIMIT de Colombia expone PII y datos de tránsito

SIMIT (Colombia)

A free 100-record sample of Colombia's SIMIT traffic-fines system is circulating, mapping license plates or IDs to full PII, GPS location and unpaid-fine amounts. The sample signals a larger dataset being marketed for sale, enabling extortion, doxxing and targeting of vehicle owners. Government PII leaks in the region are directly relevant to national fraud and public-sector risk.