Underground · what matters today

Base de datos de 40 millones de clientes de Payback Alemania a la venta

Payback (Alemania)

Actor 'Koshyrman' is selling a 40-million-record database belonging to Payback, a major German loyalty and payments program. Such a leak exposes extensive customer PII (names, addresses, emails, phone numbers) and enables mass phishing, credential stuffing and account takeover. It is outside Latin America, but its scale and recency make it a credible large-breach sale worth tracking.

Datos de clientes de Binance Australia a la venta

Binance Australia

A RaidForums seller is offering a dump of Binance Australia customer data for sale. Compromised exchange records expose account holders to targeted phishing, credential stuffing and SIM-swap fraud. Security teams at the exchange and its customers should watch for follow-on account-takeover and social-engineering campaigns.

Base de datos de 109.392 usuarios de Coinbase a la venta

Coinbase

A RaidForums seller is offering a database of 109,392 Coinbase accounts with balances attached, indicating compromised credentials of real users. Such records fuel targeted phishing, credential stuffing and account takeover against crypto holders, who face direct financial loss. Defenders should treat it as a credential-leak signal and push MFA and password resets to affected accounts.

Filtración de datos de la alimentaria brasileña Integra Foods

integrafoods.ind.br

A database from the Brazilian food company Integra Foods (integrafoods.ind.br) was posted on a leaks forum. The thread is dated July 2023, so this is stale material rather than a fresh incident. It is included only for correlation, not as a new alert.

Filtración de 175.000 números de teléfono vinculados a HSBC

HSBC

A free dump of roughly 175,000 phone numbers linked to HSBC bank customers is being shared. Although limited to contact data, it is a strong base for vishing and account-takeover attempts against banking customers. Financial-sector fraud teams should feed these numbers into anti-fraud monitoring.

Filtración de datos de los operadores neerlandeses Odido NL y Ben.nl

Odido NL / Ben.nl

A leak attributed to Dutch telecom operators Odido and Ben.nl is being shared, posted by a ShinyHunters-affiliated account in early October 2026. Telecom customer data supports SIM-swap, phishing and account-takeover campaigns. It is a critical-infrastructure-adjacent exposure even though outside LATAM.

Base de datos de 2 TB del DMV del estado de Florida a la venta

Florida DMV

A listing claims to sell a 2 TB 2026 dataset from the Florida Department of Motor Vehicles, which would include identity and licence data for millions of residents. Such material is ideal for identity theft and synthetic fraud. Defenders and fraud teams should prepare for downstream credential and identity abuse.

ShinyHunters publica 6,5 TB de datos vinculados a Salesforce

Salesforce

The ShinyHunters collective is circulating a 6.5 TB dump labelled as Salesforce '99 files', posted in early October 2026. If it contains tenant or customer CRM data, it can expose business pipelines and personal data of many downstream organisations. Enterprises using Salesforce should validate scope and monitor for credential reuse.

Filtración de la base de datos de 2,1 TB de Namecheap

Namecheap

A 2.1 TB database attributed to domain registrar and hosting provider Namecheap is being freely shared. Leakage of registrar/customer data can enable account takeover, domain hijacking and phishing against a large customer base. Anyone hosting or depending on Namecheap domains should review this exposure.

Filtración de bases de datos y documentos de la policía de México

Policía de México

A thread posted within the last day offers Mexican police databases together with supporting documents, exposing law-enforcement identities and internal records. This kind of leak fuels extortion, targeting of officers and cartel intelligence gathering. It should be treated as a high-priority LATAM government-related exposure.

Volcado de 9 millones de filas de Avito (clasificados de Rusia) en verificación

Avito (Rusia)

A poster is verifying a claimed 9-million-row dump from Avito, Russia's largest classifieds platform. Such a dataset can fuel targeted phishing and account takeover at scale. Outside the AR-LATAM region and unverified, but monitor for resale and credential reuse.

Base de datos de 13 millones de ciudadanos y empresas de Filipinas a la venta

Filipinas — ciudadanos y empresas

A seller claims a 13-million-record database covering Philippine customers, citizens and companies. If real, it exposes nationwide PII at national scale, enabling identity theft, phishing and account takeover. Not the AR-LATAM region, but a large citizen data leak worth tracking for downstream abuse.

Base de datos de una aseguradora japonesa publicada

Japanese insurance company (unnamed)

A freshly posted DarkForums thread dated within minutes of discovery offers a database labeled 'Japan_insurance', pointing to records from a Japanese insurer. Insurance data is high-value for fraud because it links identity, policy and financial details. The victim is not named and the size is unstated, so it needs verification, but the recency makes it worth tracking.

Filtración de la base de datos de la plataforma Paidwork

Paidwork.com

A DarkForums post dated 14 August 2026 shares a 'cleaned' database from Paidwork.com, a freelancing/payout platform, likely containing user account and contact data. Freelance and payout platforms are attractive for follow-on account-takeover and financial fraud against workers. It is a mid-sized, roughly two-month-old leak, so it is worth surfacing but not a fresh emergency.

Filtración de historiales de pacientes de LabQuest, Rusia

LabQuest (labquest.ru)

A forum post offers a 466,000-row database from LabQuest, a Russian medical lab, reportedly containing patient records plus PST email archives belonging to top managers. The executive mailboxes are the notable part, since they can enable business-email-compromise and lateral phishing. Scale is modest, so it ranks below the larger regional leaks but still exposes healthcare PII.

Filtración de 554M de líneas de la base de datos de Gemotest

Gemotest (gemotest.ru)

A BreachForums thread discusses a claimed 554-million-line database from Gemotest, a large Russian medical-testing lab, reportedly covering customer orders and patient records. Such a volume implies massive exposure of sensitive health and identity data for a real healthcare provider. Defenders in healthcare should note the pattern of medical-lab data being traded in bulk and watch for credential-stuffing against related portals.

Filtración no verificada de 210 millones de filas de Gosuslugi (servicios estatales de Rusia)

Gosuslugi (Russian state services portal)

A forum poster is verifying a claim of 210 million rows allegedly from Gosuslugi, Russia's national state-services portal. If authentic, this would rank among the largest government data exposures, exposing citizen identities, benefits and tax data at massive scale. Treat as unverified but high-impact and track for corroboration and resale.

Filtración de datos SCADA del sistema de control Qingyuan (China)

Qingyuan Tracking System

A collection reportedly containing SCADA/tracking control-system data from Qingyuan, China, is being shared on BreachForums. SCADA exposures can reveal ICS network topology, credentials and device configuration, enabling downstream attacks on critical infrastructure. Though outside Argentina/LATAM, it is relevant as an ICS/OT data exposure and for tracking actors who resell such industrial data.

Base de datos de 3TB de Salesforce publicada en foro clandestino

Salesforce

A 3TB database labeled 'Salesforce 2026' was posted on DarkForums only minutes ago, pointing to a very large and potentially fresh exfiltration. Salesforce is widely used by enterprises and public bodies, so a leak of this size could expose customer records and business data across many victim organizations. Defenders should watch for credential reuse and customer-targeting phishing.

Base de datos de las telefónicas Asiacell y Zain Iraq a la venta

Asiacell / Zain Iraq

An actor claims to hold and sell data from Iraqi mobile carriers Asiacell and Zain Iraq, i.e. subscriber records tied to telecom infrastructure. Compromised subscriber data can fuel SIM-swap fraud, account takeover and surveillance of subscribers. Telecom defenders should verify the scope and monitor for reuse of this data.

Filtración de 19 millones de registros de Pathao (Bangladesh)

Pathao

Actors are leaking a claimed 19-million-record database tied to Pathao, a Bangladeshi ride-hailing and delivery company, despite the firm calling the incident 'partial'. It exposes rider and driver PII at large scale, enabling identity theft and targeted phishing. Relevant for defenders tracking large consumer-platform leaks and for any downstream credential abuse.

Base de datos de banco japonés con 46 millones de líneas a la venta

Banco japonés sin identificar

A seller on DarkForums is offering a stolen database described as a Japanese bank containing 46 million lines. The volume points to a large-scale financial data theft covering customer and account records. Financial institutions and fraud teams should treat it as a credible source for account-takeover, credential-stuffing and carding abuse.

Filtración de 11 millones de credenciales URL:login:pass

A dump titled '11M UHQ URL:LOGIN:PASS' was posted on NulledBB, offering roughly 11 million credential pairs. Although no single organisation is named, the volume makes it valuable for credential-stuffing and account-takeover campaigns. Defenders should enforce MFA and monitor for reuse of these logins.

Base de datos de 100K de scalextric.es con DNI a la venta

scalextric.es

A seller is offering a 100K-record database of the Spanish retailer scalextric.es with DNI (national ID) data included. Leaked national IDs enable identity fraud and account takeover against Spanish residents. Worth tracking for downstream credential and KYC abuse.