Underground · what matters today
The underground stories that broke through this window. Gov/mil, access sales, ransomware, leaks, stealers. Screenshots and context on each.
Distribution by category · window
- Gov / Military54
- Access sale41
- Ransomware50
- Leak415
- Stealer0
- Other10
Window
Category
Severity
Base de datos de la Embajada de Albania en Moscú filtrada
Albanian Embassy in Moscow
A leak thread from May 2023 claims to expose a database belonging to the Albanian Embassy in Moscow, a diplomatic target. The material is over three years old and concerns a single mission outside Latin America, so it is not a fresh alert. It is noted only as background on sustained targeting of diplomatic entities, which defenders of government networks may find contextual.
Base de datos de delegados de la ONU filtrada
United Nations
A forum post from December 2024 shares what it claims is a United Nations delegates database, a potentially sensitive diplomatic dataset. The post is nearly two years old, so it is not a fresh alert, but such data can still support targeted phishing against officials and diplomatic staff. Any LatAm delegations represented in it warrant awareness rather than immediate action.
Venta de 16 millones de registros de la Punjab Land Records Authority (Pakistán)
Punjab Land Records Authority (Pakistan)
A seller is offering a 16 million record database attributed to the Punjab Land Records Authority, a Pakistani provincial government body, behind a login wall. Government land and property records tie directly to citizens' identities and ownership, making this a high-sensitivity sale even though it is outside Latin America. Buyers actively seeking government datasets should be treated as a broader leak-market signal for defenders.
Filtración de 42 millones de registros de Charter Communications
Charter Communications
A leak forum thread claims a 42 million record dataset tied to Charter Communications, a major US telecom and critical-infrastructure operator. The post dates to January 2026, so it is not a fresh alert, but the dataset's size and telecom relevance still justify verification. Defenders should test whether customer or employee data overlaps their own exposure or third parties.
Base de datos completa de México con 104,2 millones de registros a la venta
México (base de datos no identificada)
A threat actor is advertising a 'Full DB Mexico' containing 104.2 million records just minutes ago, a scale consistent with a national-level compilation. The source organization is undisclosed, but the volume and Mexican origin make it highly relevant to LatAm defenders and data-protection teams. If authentic, it could fuel mass identity fraud and credential stuffing against Mexican services.
Base de datos del portal gubernamental chipriota gigavoucher.dmrid.gov.cy
gigavoucher.dmrid.gov.cy (Gobierno de Chipre)
A forum user is offering a customer database allegedly taken from gigavoucher.dmrid.gov.cy, a Cyprus government (.gov.cy) service portal tied to the shipping ministry. Government customer records typically include names, identifiers, emails and contact details that enable targeted phishing and account takeover against public services. The post date is ambiguous and may be several months old, so it ranks below fresh alerts but remains relevant for any entity transacting with Cypriot government portals.
Filtración de base de datos del Ministerio de Salud de Francia (sante.gouv.fr)
Ministère de la Santé / sante.gouv.fr (Francia)
A threat actor is distributing a database allegedly extracted from sante.gouv.fr, the French Ministry of Health portal, posted on DarkForums within the last day. Although the record count and schema are not yet confirmed, a leak from a national health ministry exposes civil-servant and citizen contact data and is a credible precursor to phishing, credential stuffing and lateral movement against public health infrastructure. Defenders in EU public-sector and healthcare supply chains should monitor for related credential reuse.
Copia de seguridad SQL de un sitio web de Panamá a la venta
Panama website (organización no identificada)
A forum listing advertises a SQL backup taken from a Panama-based website, potentially exposing user accounts, contact data and administrative records. If the site belongs to a public or regulated entity, the impact extends to citizens and downstream services in the region. The organization is not clearly identified and the date is unknown, so this needs validation before escalation.
Filtración de base de datos de 22 millones de usuarios de YouNow
YouNow
A full-platform export of YouNow with 22 million user records is being offered for download, likely including emails, usernames and profile data. Leaks of this size enable credential stuffing against other services and targeted harassment or phishing of users. The listing date is unclear, so verify recency before treating it as a new incident.
Base de datos del minorista ruso Wildberries a la venta
Wildberries
A seller is advertising a 2026 database from Wildberries, Russia's largest online retailer, which would contain vast customer, order and contact data. Retail datasets of this size fuel credential stuffing, phishing and parcel/order fraud across a large user base. The post is fresh, so it should be tracked for sample verification and downstream reuse.
Base de datos de inversores de Vanguard Group a la venta
The Vanguard Group
A seller claims to hold a database of The Vanguard Group, the US asset-management giant, covering mutual-fund, ETF and stock investors. Financial investor data is high-value for targeted phishing, account takeover and identity fraud, and can be cross-referenced against brokerage accounts. The listing is minutes old, so validation and customer-notification work should start now.
Base de datos del banco HSBC con 175.000 registros filtrada
HSBC
A 175,000-record database attributed to HSBC is being distributed free, likely containing customer or account data. Even a partial banking dataset exposes individuals to phishing, account takeover and social-engineering fraud, and pressures the institution's fraud teams. The date is unclear, so treat as unverified but worth monitoring for credential and PII reuse.
Base de datos de 16 millones de registros de Punjab Land Records a la venta
Punjab Land Records Authority
A seller is offering a 16-million-record dataset allegedly taken from the Punjab Land Records Authority, a government body holding land-ownership and citizen identity data. Records of this scale enable mass identity theft, targeted impersonation and fraud against citizens, plus downstream attacks on linked services. The post is only hours old, giving defenders a short window to warn affected parties and monitor for reuse of the data.
Base de datos de 11 millones de cuentas de Poshmark en circulación
Poshmark
An 11 million line Poshmark email:password dataset is circulating in an exchange thread that appears to be aged rather than a fresh breach. Credentials enable credential-stuffing against Poshmark and, through reuse, other accounts. Because the thread looks stale, value is mostly baseline fraud intelligence rather than a new incident.
Filtración de la red Ram Dor, filial del grupo israelí Toup
Ram Dor (Toup Group)
A threat actor claims to have infiltrated the network of Ram Dor, a subsidiary of Israel's Toup Group, and is publishing a database from the intrusion. The dump may expose internal systems and customer records of the conglomerate. This matters for supply-chain and regional market awareness even though it is not in Latin America.
Base de datos de 16 millones de registros de Punjab a la venta
Punjab Land Records Authority
An actor is selling a 16 million record dataset allegedly from the Punjab Land Records Authority, a Pakistani government body holding citizen land and identity records. Government land registries enable identity theft, property fraud and impersonation of officials. The scale and official nature justify monitoring despite being outside LATAM.
Filtración de 36 millones de registros de usuarios de Evite
Evite
A 36 million record dataset attributed to Evite, a US online invitations service, is being offered for sale in a recently posted thread. Such dumps typically include emails, names and account metadata that fuel phishing, credential stuffing and spam campaigns. Large fresh consumer datasets are high-value for downstream account-takeover chains.
Filtración de base de datos de clientes de la aseguradora Sava Osiguranje
Sava Osiguranje (Serbia)
A threat actor posted a customer database belonging to Sava Osiguranje, a Serbian insurance company, on a leak forum minutes ago. Insurance customer records typically include names, policy details, contact and payment data that fuel fraud, phishing and account takeover. Even outside LATAM, a fresh leak from a regulated financial-sector firm is worth monitoring for downstream abuse.
Base de datos de 16M de registros del catastro de Punjab a la venta
Punjab Land Records Authority (Pakistán)
A seller is offering a 16 million record database from the Punjab Land Records Authority, a Pakistani government body that holds citizens' property and ownership data. Leaked land records expose identity, property and financial details that enable large-scale fraud and targeted extortion against owners. The listing is fresh, showing the data is being actively marketed to buyers right now.
Reportan compromiso de Gcore a través del panel ISPsystem
Gcore
A hosting community thread claims Gcore, a global cloud/CDN and hosting provider, was compromised through an ISPsystem control panel. If accurate, this means attacker control over provisioning infrastructure used by many downstream customers, including regional resellers and hosted services in Latin America. The claim is unverified and undated, so treat it as a lead to validate against Gcore's own advisories rather than confirmed fact.
Filtración de 780K registros de Brasil, parte 1 del lote de América Latina
Brasil (lote de datos de América Latina)
A forum actor is releasing a 780K-record Brazilian dataset explicitly framed as the first part of a Latin America collection, meaning further country batches (possibly Argentina) are likely to follow. Consumer and possibly corporate PII of this size fuels credential stuffing, phishing and identity fraud against regional users and service providers. Defenders in the region should treat it as an early warning and prepare for follow-on batches.
Datos de la OTAN supuestamente filtrados por SiegedSec
OTAN (NATO)
A fresh forum post claims the group SiegedSec has leaked NATO data, though the scale and contents are unverified and could be recycled material. Even so, a claimed leak tied to a defense/military alliance warrants rapid authenticity checks given past data-reuse by actors. Analysts should validate the dataset and monitor for downstream publication before treating it as confirmed.
Base de datos del gobierno de Sindh (Pakistán) con 10,6 millones de registros a la venta
Gobierno de Sindh, Pakistán (registro vehicular)
A forum user is offering a 10.6-million-record database tied to the Sindh provincial government (vehicle registration), posted within the last day. The scale indicates a mass exfiltration of citizen PII such as names, IDs, and registration details, enabling identity fraud and targeted attacks. Defenders in government vehicle/licensing services should verify the authenticity and treat exposed identifiers as compromised.
Base de datos de 109 millones de Turquía a la venta
Turkey (unspecified)
An onion forum offers a 109 million-record Turkish database for sale. The content and provenance are unverified because the thread is behind a login wall. If genuine, it is one of the largest national datasets in circulation and could fuel mass fraud and credential attacks.