Underground · what matters today

Dump del SIMIT de Colombia expone PII y datos de tránsito

SIMIT (Colombia)

A free 100-record sample of Colombia's SIMIT traffic-fines system is circulating, mapping license plates or IDs to full PII, GPS location and unpaid-fine amounts. The sample signals a larger dataset being marketed for sale, enabling extortion, doxxing and targeting of vehicle owners. Government PII leaks in the region are directly relevant to national fraud and public-sector risk.

Base de datos del exchange chileno OrionX publicada en foro

OrionX (orionx.com)

A threat actor posted a database allegedly belonging to OrionX, a Chilean cryptocurrency exchange, minutes before this capture. If genuine it exposes customer PII and account data of a regulated financial platform serving Chile and Latin America, enabling phishing, SIM-swap and account-takeover fraud. Crypto exchanges are high-value laundering and theft targets, making this a priority regional leak.

Base de datos completa del gobierno de México (Gob.mx) ofrece en venta

Gobierno de México (Gob.mx)

A forum user posted a 'full database' allegedly belonging to Gob.mx, the Mexican federal government web portal, minutes before this capture. A government portal dataset can hold citizen PII, credentials and internal documents, enabling targeted phishing and account takeover against public employees. Any credible Mexican federal-government leak carries national-security and fraud implications and should be verified immediately.

A la venta 1,8 millones de identidades de residentes de Pemalang

Pemalang (Indonesia)

A database containing the identities of 1.8 million residents of Pemalang, Indonesia, is offered for sale. Government-held citizen data at this scale is a strong identity-theft and fraud risk. It signals weak protection of a regional civil registry and can feed synthetic-identity schemes.

Filtración de base de datos de la turística TheTourGuy (3,8 M)

TheTourGuy

TheTourGuy, a US tour operator, appears in a 3.8-million-record database dump dated 2026. The dataset likely holds customer booking and payment details. Even mid-size travel leaks matter for credential stuffing and card fraud, and travel-sector data is often reused across services.

Filtración completa de historias clínicas de Cook Counseling

Cook Counseling and Consulting

A full electronic health record (EHR) dump of Cook Counseling and Consulting, a mental health clinic, has been posted. Healthcare records are among the most sensitive data types, covering diagnoses and treatment. Exposure enables insurance fraud, patient blackmail and serious regulatory liability.

Base de datos de Fluke (21 millones de registros) a la venta

Fluke

A 21-million-record database linked to Fluke, a US industrial electrical-test equipment maker, is offered for sale in 2026. At this scale it likely contains customer, partner and employee data. Such corporate data enables targeted phishing and supply-chain reconnaissance against industrial and OT-relevant targets.

Filtración de base de datos de la empresa argentina Solventium

Solventium (.com.ar)

A dump named solventium.com.ar.txt was posted on DarkForums today, targeting an Argentine company. The .com.ar domain indicates corporate or customer records from Argentina. Freshly published dumps like this are quickly weaponised for fraud, phishing and credential abuse against local clients and partners.

Base de datos de RevenueBase.ai con más de 150 millones de contactos a la venta

RevenueBase.ai

A large dataset of 150M+ contact and company records attributed to RevenueBase.ai is being advertised for sale on DarkForums in 2026. The scale implies broad personal and business contact information that is well suited to targeted phishing and social engineering campaigns. It is a US-focused data-broker style set rather than a LATAM government breach, so it matters mainly as fuel for downstream attacks against any organization in the region that appears in it.

Venta de 57.000 correos filtrados de la Facultad de Ciencias de la UNAM

UNAM – Facultad de Ciencias

A seller is offering roughly 57,000 email records tied to the Faculty of Sciences (Facultad de Ciencias) of Mexico's National Autonomous University (UNAM), a major public institution in Latin America. Although the exact format is unconfirmed, mail dumps of this size typically bundle valid credentials that enable credential-stuffing, phishing and account takeover of university staff and students. For a LATAM defender this is a named, region-relevant academic target whose stolen mailboxes can be reused for further intrusion and lateral movement.

A la venta 4,8 millones de registros de estudiantes del FLDOE

Florida Department of Education (FLDOE)

A seller is advertising a database of roughly 4.8 million student records attributed to the Florida Department of Education, containing SSNs, dates of birth and full names. If authentic, it is a large, high-value identity-theft trove affecting minors, making it useful for fraud, account takeover and synthetic identity creation. Defenders should treat it as a real leak until disproven and watch for downstream abuse.

Base de datos filtrada de Double Counter (verificación de Discord)

Double Counter

A forum thread advertises a leaked Double Counter database, the Discord verification/anti-bot service used by many large servers. If genuine, it could expose user IDs, emails and verification metadata affecting thousands of Discord communities. The post is login-walled and unconfirmed, so treat it as worth monitoring rather than a confirmed breach.

Filtración de datos del corredor de seguros L&G

L&G Insurance Broker

An actor posted a leaked dataset attributed to L&G Insurance Broker for download in a database/source-code section, minutes before collection. Insurance records typically contain customer PII and policy details that fuel fraud, phishing and account takeover. Financial-services defenders should verify the exposure and monitor for identity abuse.

Dump gratuito de 26,2 millones de credenciales en foros

A fresh 12-Oct-2026 dump of roughly 26.2 million credential lines is being released for free in ten parts across underground forums. The lines appear to be URL:login:password stealer logs, so they can fuel credential-stuffing and account-takeover against any exposed service. Defenders should ingest them into credential-monitoring and force resets on any matching corporate accounts.

Filtración de la base de identidad NADRA de Pakistán (900 GB)

NADRA (Pakistan)

A 900 GB database allegedly holding full identity records of Pakistani citizens (NADRA) is being distributed for free. It reportedly includes names, national ID numbers, addresses and family details, enabling mass identity theft, synthetic-identity fraud and targeted social engineering. Defenders should track downstream use of these records in KYC bypass and account-takeover campaigns far beyond Pakistan.

Base de datos de líderes empresariales rusos (2025) a la venta

Líderes empresariales rusos

A corporate database of Russian business leaders (2025 data) is being advertised on DarkForums, reportedly containing executive and company details. Although it is outside the Argentina/LatAm scope, large executive datasets fuel highly targeted phishing, BEC and social-engineering against named individuals. It is partially stale (2025) and its real scale is unverified, so it merits tracking rather than an immediate alert.

Filtración de base de datos de Instagram: 17 millones de registros

Instagram

A Turkish hacking forum is circulating a dump advertised as a 17-million-record Instagram database, with the original thread dated July 2026 and renewed replies in early October. If authentic it can fuel credential-stuffing and account takeover against a platform heavily used across Latin America, though the age and unverified scope lower its operational priority. Treat it as a credential-hygiene driver (MFA, reuse monitoring) rather than a live incident.

Filtración de datos del proveedor fintech Kiple

Kiple

A post offers the leaked database of Kiple, a fintech/payments provider, for download. The thread dates to late 2025, so it is stale rather than a fresh alert. Still relevant for defenders at the victim to gauge exposed customer data.

Filtración de 17 millones de cuentas de Instagram

Instagram (Meta)

A forum thread claims a 17-million-record Instagram database is available, with posts as recent as October 2026. Such dumps are usually recycled or fabricated, and Instagram is a global consumer platform rather than a government or critical-infrastructure target. Value is limited unless records are validated against real credentials.

Base de datos de Anka filtrada para descarga

Anka

A BreachForums thread offers a leaked database named 'Anka' for direct download. The affected organization and record count are not specified, making impact hard to assess. Watch for confirmation of the victim and the data scope.

Combolist de 468.000 credenciales de Brasil

A fresh BreachForums post offers a combolist of roughly 468,000 Brazilian email/password credentials labeled HQ. Brazil is in the LATAM scope, and this feeds credential-stuffing against Brazilian services. No specific organization is named, so it is a broad exposure rather than a targeted breach.

Filtración de base de datos de la mexicana iPESA Pintures

iPESA Pintures (pintando.com.mx)

A threat actor is publishing a database allegedly belonging to Mexican paint retailer iPESA Pintures (pintando.com.mx). If genuine, the dump exposes customer and possibly corporate records usable for phishing, fraud and credential stuffing against Mexican users. Mexican organizations and resellers should verify the exposure and warn affected customers.

Filtración de datos del servicio anti-bot DoubleCounter.gg

DoubleCounter.gg

A breach of DoubleCounter.gg, a Discord anti-alt and verification service, was posted on 11 October 2026. The platform stores user IDs, IP addresses and verification metadata for many communities, so the leak can expose linked accounts and infrastructure details. It is niche and non-regional, but fresh and could feed downstream account and fraud attacks.

Base de datos de 2 millones de suscriptores móviles de Indonesia a la venta

Suscriptores móviles (Indonesia)

A seller is offering a database of 2 million Indonesian mobile subscribers reportedly derived from SIM-card registration records, including identity and phone data. This is a large telecom dataset that enables SIM-swap, fraud and identity theft at national scale. It sits outside the LATAM region, so it is relevant as a sizeable national telecom leak but not a regional alert.