Underground · what matters today

Venta de webshell y acceso a base de datos de Malasia (0-day)

Malaysian organization (unnamed)

A seller advertises an unauthenticated webshell with database access against a Malaysian target, framing it as a critical 0-day. Sale of ready-made webshell access is a direct precursor to data theft and ransomware deployment. Besides the direct victim, it signals an exploitable web-facing flaw that regional organizations running similar stacks should patch and hunt for.

Filtración de archivo de correos diplomáticos de Israel

Israeli diplomatic service

An actor published a claimed archive of Israeli diplomatic emails on a major leak forum on 21 October 2026. Diplomatic correspondence is highly sensitive and fuels spearphishing, impersonation and intelligence collection against government contacts worldwide, including Latin American counterparts. Regional foreign ministries and embassies should treat inbound Israeli-government-themed email with heightened scrutiny.

Accesos RDP con privilegios de administrador a la venta en un foro clandestino

A verified seller on the BlackBones carding forum advertises remote desktop access with administrator rights, the kind of foothold typically harvested from commodity infostealer logs and exposed RDP services. The post names no victim, country or IP range, so it cannot currently be tied to an Argentine or Latin American organisation, but admin RDP access is a standard entry point for ransomware affiliates and access brokers. Worth monitoring this seller for follow-up posts that list specific companies or geolocations.

Base de datos de 3M de la estatal venezolana Farmapatria filtrada

Farmapatria (empresa estatal de alimentos, Venezuela)

A roughly 3-million-record database attributed to Farmapatria, the Venezuelan state food production and distribution company under the food ministry, is being redistributed on a leak forum. Although marked as a repost, exposure of citizen, supplier and distribution data tied to a state entity is high-value for social engineering and fraud. Defenders in Venezuelan public-sector supply chains should verify the records and monitor for credential reuse.

Base de datos de afiliados a EPS de Colombia a la venta

EPS (sistema de salud de Colombia)

A threat actor is advertising a database containing enrollee records from Colombia's EPS public health-insurance system, which aggregates affiliation and personal data for millions of citizens. Such datasets expose national ID numbers, contact details and health-coverage status, enabling identity theft, social-engineering and targeted fraud against patients. Health-sector data in Latin America is critical infrastructure-adjacent, so defenders should validate the claim and monitor for downstream credential-stuffing against EPS portals.

Filtración de 11 millones de credenciales de Poshmark

Poshmark

A thread advertises an 11 million-record Poshmark email:password combolist. Poshmark suffered a widely reported breach exposing millions of accounts, so this matches an older, resold dataset rather than new access. Low urgency, but it confirms ongoing trafficking of its users' credentials for account takeover.

Base de datos de clientes de Under Armour a la venta

Under Armour

DarkForums lists a customer database for underarmour.com in its 'Databases' section. Under Armour disclosed a 2018 breach of roughly 150M accounts, so this is almost certainly a repackaged or resold copy rather than a fresh intrusion. Only mildly useful as a reminder of credential-stuffing and phishing exposure for its user base.

Base de datos de Jaguar Land Rover filtrada en un foro

Jaguar Land Rover

A BreachForums thread advertises a leaked Jaguar Land Rover database available for download. The automotive manufacturer has suffered significant prior intrusions, so this may be a repost of older data rather than a fresh breach, which lowers urgency. Still, it is a named high-profile enterprise dataset worth verifying for freshness and downstream credential/PII exposure.

Filtración de datos de DoorDash publicada en un foro

DoorDash

A thread dated 19 October 2026 offers a DoorDash data set for download on DarkForums. DoorDash is a large food-delivery platform, so any leaked customer, courier or merchant data carries fraud and account-takeover risk. Although it is not a LATAM or government target, a fresh large-org leak is worth tracking for downstream credential and PII abuse.

Filtración de base de datos de la aseguradora ARS Meta Salud (Rep. Dominicana)

ARS Meta Salud

A full database belonging to ARS Meta Salud, a Dominican Republic health insurer, has just been posted for download on DarkForums. Health insurers hold sensitive patient and policyholder PII (names, IDs, coverage, contact data), making this a high-value leak for fraud and phishing. Defenders in the LATAM health sector should treat this as a fresh, region-relevant exposure and monitor for credential stuffing and social engineering against members.

Filtración de base de datos del cartório brasileño 1cartoriosbc.com.br

1cartoriosbc.com.br

A threat actor posted a username:password database attributed to 1cartoriosbc.com.br, a Brazilian notary (cartório) web service, in a public leak forum. Notary offices hold identity, property and contract records, so even a site-level credential dump can feed account takeover against staff and downstream fraud. It is fresh and regionally relevant, though scale and record sensitivity are not yet confirmed.

Primer comunicado del actor que filtra datos del Estado ecuatoriano

Pheisito (actor)

A 'first communiqué' posted by the same actor who is simultaneously publishing ECU911/Police, military, CNEL and Judicial Council databases from Ecuador. It likely states the group's motives, demands or leak schedule, which helps defenders anticipate the next victims. Content was not fully readable, so treat as context rather than confirmed intelligence.

Base de datos de vulnerabilidades de Ecuador publicada en foro

Sector público de Ecuador

A dataset titled as an Ecuadorian vulnerabilities database has been shared on a hacking forum, likely cataloguing vulnerable government systems or exposures. Such a list acts as a targeting map for intrusion into public entities and should be triaged against exposed services. It is fresh and tied to an actor actively dumping Ecuadorian state data.

Base de datos del Consejo de la Judicatura de Ecuador filtrada

Consejo de la Judicatura del Ecuador

A database belonging to the Consejo de la Judicatura, the body governing Ecuador's judiciary, has been posted on a hacking forum. Judicial records can expose judges, case data and internal systems, enabling intimidation of magistrates or manipulation of legal proceedings. The post appears minutes old and belongs to the same cluster of Ecuadorian state leaks.

Datos militares de Ecuador ofrecidos en foro de hacking

Fuerzas Armadas del Ecuador

A dataset labelled as Ecuadorian military data ('MIL DATOS') has been posted for distribution on a hacking forum. If authentic, exposure of armed-forces personnel or operational records poses a direct national-security risk and enables targeted phishing or physical threats against service members. The listing is minutes old and part of a broader Ecuadorian government leak campaign.

Base de datos de ECU911 y Policía Nacional de Ecuador filtrada

ECU911 / Policía Nacional del Ecuador

A database attributed to ECU911, Ecuador's national emergency response service, and the National Police has been published on a hacking forum. Exposure of emergency-call and police data can reveal personnel, callers and operational details useful for targeting responders or intimidating victims. The post is fresh and posted by an actor concurrently dumping other Ecuadorian state databases.

CNEL y Registro Civil de Ecuador hackeados con acceso root

CNEL / Registro Civil de Ecuador

A forum actor claims to hold root-level access to Ecuador's state electricity utility CNEL and the national Civil Registry, both critical infrastructure and identity systems. Root access to these systems would allow tampering with citizen identity records and operational control of power infrastructure. The post is minutes old, making it an immediate incident-response priority for Ecuadorian authorities.

Circulan 11 millones de credenciales de Poshmark

Poshmark

A bulk mail:pass list attributed to Poshmark with roughly 11 million email and password pairs is being re-shared across forums, without a clear original breach date. Large e-commerce credential sets like this fuel account takeover, resale fraud and password-spraying against unrelated services where users reused passwords. Treat it as recycled data for credential-hygiene monitoring rather than a fresh incident.

Presunta filtración de 874 GB de datos de Fiserv

Fiserv

A forum user posted a claim of an 874 GB dump allegedly taken from Fiserv, the payments and core-banking processor behind First Data, Clover and hundreds of bank integrations. The volume suggests full database or file-share exfiltration rather than a small combolist. If genuine, downstream fraud, card and account data exposure could hit banks across the US and LatAm correspondents, so the claim should be validated before it spreads.

Filtración de base de datos de la telefónica PTML (Ufone)

Pakistan Telecommunications Mobile Limited (PTML/Ufone)

A fresh thread published yesterday claims to leak a database from Pakistan Telecommunications Mobile Limited (Ufone), a national mobile carrier. Telecom subscriber and employee records of this scale enable SIM-swap, phishing and account-takeover campaigns affecting millions of users. Although outside Latin America, it is a current large-scale leak worth tracking for downstream credential reuse.

Base de datos masiva brasileña de Serasa a la venta

Serasa Experian (Brasil)

A large Brazilian database attributed to Serasa, Experian's credit bureau, is circulating for sale or leak. Serasa holds credit and consumer financial data, so any genuine breach would be high-impact for fraud and identity theft. However the thread appears old/second-hand, so treat it as likely stale rather than a fresh breach; verify before alerting.

Base de datos del INE de Campeche, México, filtrada

INE - Instituto Nacional Electoral (Campeche)

A threat actor posted a database linked to Mexico's INE (Instituto Nacional Electoral) for the state of Campeche. Electoral data is highly sensitive, involving voter and citizen records that can be abused for identity fraud or influence operations. Authorities should confirm the scope and notify affected citizens.

Base de datos y documentos de la policía mexicana a la venta

Policía de México

A forum actor posted databases and documents attributed to the Mexican police, potentially exposing officer records, internal files and personal data. Leaks of law-enforcement data enable doxxing and targeting of personnel and can reveal operational details. Defenders should verify the exposure and warn affected units and staff.

Base de datos de Cuba: Telefonía y Presidencia expuestas

Cuba - ETECSA / Presidencia

A forum actor has published what is presented as databases belonging to Cuban state telecommunications and the Presidency, posted within the last minutes. If genuine, this is a direct exposure of government and critical-infrastructure data in Latin America, including personal data of officials and subscriber information. Defenders in the region should treat Cuban government and telecom infrastructure as actively targeted and review credential and data exposure.