Underground · what matters today

Filtración de base de datos del Ministerio de Educación de Marruecos

Morocco Ministry of Education

A forum user posted what they claim is a database from Morocco's national Ministry of Education, a government body, roughly seven hours ago. Ministry of Education data typically includes staff and student PII, internal contacts and possibly authentication material, which enables targeted phishing and account takeover. Off-region but a fresh named government leak worth verifying for scope and authenticity.

Filtración de datos del sitio gubernamental indio ICAR Pune

ataripune.icar.gov.in (ICAR, India)

A five-hour-old post claims a database leak from ataripune.icar.gov.in, a subdomain of India's agricultural research council. Government research portals often hold staff and research data useful for phishing and reconnaissance against public institutions. It is outside the Latin American focus but still a genuine government-domain exposure.

Base de datos filtrada del emisor iraquí de tarjetas QiCard

QiCard (Irak)

A new DarkForums thread advertises a leaked database from QiCard, Iraq's main national payment-card provider. Compromised cardholder or subscriber data from a payment system carries direct financial-fraud and account-takeover risk. Scale and authenticity are not yet evidenced, so verification is required.

Venta de la base de datos de Motos del Oriente (Colombia)

Motos del Oriente (Colombia)

A seller is offering a database of about 207,000 records from the Colombian motorcycle dealer Motos del Oriente. Customer PII from a retailer supports phishing, credit application fraud and impersonation of buyers. It is a modest but regional leak worth tracking for Colombian consumer and financial-sector defenders.

Venta de 10 millones de datos personales de Thrive Online Group

Thrive Online Group (Sudáfrica)

A seller lists roughly 10 million PII records belonging to South Africa's Thrive Online Group for sale on a private forum. The volume and personal-data nature make it valuable for identity theft and large-scale phishing against South African consumers. Details are login-walled, so scope and recency still need independent confirmation.

Base de datos de 820 millones de usuarios de Alipay a la venta

Alipay (Ant Group)

A poster claims to hold a full database of 820 million Alipay users, a scale that would make it one of the largest financial-data leaks ever offered. Such claims are frequently recycled or exaggerated, so authenticity must be verified before action. If real, it would fuel massive credential-stuffing and payment-fraud campaigns globally.

Filtración de 689.000 registros del portal urssaf.fr de Francia

URSSAF (Francia)

A fresh DarkForums post offers roughly 689,000 records tied to PajEmploi, a service of France's URSSAF social-contribution agency. Such data can be abused for fraudulent benefit claims, impersonation and business-owner phishing. Because the source is a government social-security body, the identity exposure is especially sensitive.

Filtración de datos personales del portal justice.fr de Francia

justice.fr (Ministerio de Justicia de Francia)

A six-hour-old post advertises a CSV export of personal data from justice.fr, the French Ministry of Justice web portal. Even a scraped or partial extract of judicial-system user data is sensitive and useful for targeted phishing of legal professionals and citizens. Public-sector defenders should verify exposure and warn affected users.

Base de datos de 8 millones de clientes de Axa Francia a la venta

Axa France

A freshly posted thread claims a database of more than 8 million Axa France customer records is available on DarkForums. A leak at that scale for a major insurer enables large-scale phishing, identity fraud and insurance-specific social engineering. Defenders should expect credential-stuffing and callback fraud targeting policyholders.

Documento interno de SpaceX sobre la constelación Starshield a la venta

SpaceX (Starshield)

A seller is offering an internal SpaceX document describing the technical baseline and architecture of the Starshield constellation, a defense-oriented satellite program. If authentic, it exposes system design details of interest to military intelligence and adversary space programs. Technical and defense-sector defenders should monitor downstream distribution.

Venta de datos del Ministerio de Educación Superior de Cuba

Ministerio de Educación Superior (Cuba)

A seller is advertising data or access tied to Cuba's Ministry of Higher Education, a sensitive government body. The thread is behind a login wall, so scale and record type are unconfirmed, but any compromise of a ministry is high-value for regional espionage and data-theft actors. Latin American government defenders should treat this as an active sale.

Presunta filtración de base de datos de empleados de YouTube

YouTube

An item claims to leak a YouTube employee database, which if genuine would expose internal staff PII valuable for targeted phishing and social engineering against a major platform. The claim is unverified and scale is unknown from the snippet. Worth sampling to confirm before elevating, since employee data can enable secondary access attempts.

Base de datos de Change Healthcare (201 GB) redistribuida

Change Healthcare

A 201 GB Change Healthcare dataset is being re-posted; this matches the previously known major US healthcare breach, so the content is likely stale re-circulation rather than a new incident. Still, it contains highly sensitive patient data whose reuse in medical fraud and phishing persists. Flag as known-but-relevant, not a fresh victim alert.

Base de datos de Reddit de 80 GB (2026) ofrecida en foro

Reddit

A freshly posted 80 GB Reddit dataset dated 2026 is being shared, potentially containing user records such as emails and activity metadata. Reddit is a global platform, but a leak of this size enables credential-stuffing and phishing against a huge user base with reach into LATAM organizations. Treat as unverified until sampled, but monitor for reuse of Reddit-linked emails in corporates accounts.

Base de datos de Fidelity Digital Assets (288,8 GB) a la venta

Fidelity Digital Assets

A 288.8 GB dataset spread across 13 record sets is being offered, attributed to Fidelity Digital Assets, a major financial/crypto custodian. If genuine, this is a very large financial-sector exposure affecting institutional and client data that could fuel BEC and account-takeover campaigns. Financial institutions and their LATAM counterparties should watch for downstream credential or account abuse.

Filtración de 120,7 millones de registros de educación de São Paulo, Brasil

Secretaria de Educação de São Paulo (Brasil)

A freshly posted 120.7 million-record database attributed to São Paulo state education is being offered, likely containing student and staff PII such as names, IDs and contact data. Brazil is a core LATAM critical-sector target, and an education dataset of this scale enables large-scale identity fraud and phishing against minors and public employees. Defenders in AR-LATAM should treat this as a high-priority exposure and monitor for credential reuse across .edu and gov-linked accounts.

Datos de clientes del Bangladesh Bank a la venta

Bangladesh Bank

Customer data attributed to Bangladesh Bank is being advertised on DarkForums, a central bank that has suffered high-profile breaches before. Leaked customer records enable fraud and account takeover. Regional relevance is limited but the target's status as a central bank warrants a look.

Base de datos del partido AK de Turquía filtrada

Partido AK (Turquía)

A database purportedly belonging to Turkey's ruling AK Party is offered on DarkForums. Political-party data often includes membership lists, donor and contact details that can be weaponized for targeting or social engineering. It is a government-adjacent leak outside LATAM but notable in scale.

Base de datos del banco turco Finansbank a la venta

Finansbank

A database attributed to Turkey's Finansbank is listed for sale on DarkForums, a financial institution handling customer accounts and transaction data. If real, leaked banking records fuel account takeover and fraud. Outside the region but a large named-bank leak worth tracking for credential reuse.

Base de datos del Bank of America supuestamente filtrada

Bank of America

A DarkForums thread claims to leak a database from Bank of America, one of the largest US financial institutions. Such claims are often repackaged or fabricated, but if genuine it would expose customer PII and financial data at massive scale. Worth triage and verification given the target's systemic importance.

Documentos de la Presidencia de Indonesia (679K) filtrados

Presidencia de Indonesia

A 679K-record dump of letters and documents addressed to the President of Indonesia is advertised on DarkForums. It appears to be exfiltrated official government correspondence, which could expose sensitive state communications and citizen data. Outside LATAM but a large government leak worth monitoring for regional spillover.

Base de datos del Instituto Estatal Electoral de Chihuahua a la venta

Instituto Estatal Electoral de Chihuahua

A DarkForums user is selling a database attributed to Mexico's Chihuahua State Electoral Institute, a government body holding voter rolls and citizen PII. If authentic, it exposes voter records and personal data enabling identity fraud or targeting of electoral staff. This is LATAM government infrastructure and should be validated and contained urgently.

Base de datos de la ANT y MTOP de Ecuador a la venta con 861.174 identidades

Agencia Nacional de Tránsito (ANT) / MTOP - Ecuador

A seller on BreachForums claims to have fully exfiltrated Ecuador's national transport database (ANT/MTOP), covering roughly 861,174 identities. The data would include citizen identity, licensing and vehicle records held by two government bodies, exposing drivers and vehicle owners to fraud and identity theft. Defenders in Ecuador should treat the dataset as public, verify the scope with the agencies and prepare notification and credential-abuse monitoring.

Combolist de 13,4 millones de credenciales URL:LOG:PASS difundido

A freshly dated combo list of roughly 13.4 million URL:login:password entries was released publicly. It is a generic credential dump rather than a single-organization breach, but at this scale it is valuable for credential stuffing against corporate VPNs, email and SaaS portals. Defenders should watch for password reuse and force resets on exposed accounts.