Underground · what matters today

Filtración de la base de datos inmobiliaria de Mykukun

Mykukun

The breach forum lists a leaked database from Mykukun, a real-estate data and analytics provider. Real-estate professional account data can be leveraged for business email compromise and targeted phishing. Smaller scale but still relevant for monitoring credential reuse.

Filtración de base de datos de clientes de Spytec GPS con 131.000 registros

Spytec GPS

A customer database of GPS-tracking vendor Spytec containing about 131,000 records is listed on a breach forum. Tracking-service customer data can expose physical-location and contact details, aiding stalking and fraud. It is a moderate-size leak worth monitoring for reused credentials.

Base de datos de Hallmark con 8 millones de registros a la venta

Hallmark

A dataset of roughly 8 million records labelled Hallmark is offered for download on a breach forum, suggesting a large customer or account database leak. At that scale it enables credential stuffing and targeted phishing against the brand and its partners. Defenders should check for reuse of corporate accounts in the dump.

Filtración de la base de datos de la autoridad SHENA de Baréin

Safety, Health and Environment National Authority (SHENA), Bahrain

A database belonging to Bahrain's Safety, Health and Environment National Authority (SHENA) is offered on a breach forum. Leaking a national regulator's records exposes staff and regulatory data useful for phishing and social engineering. Government and critical-infrastructure defenders should treat it as a credible leak and monitor for credential reuse.

Filtración de base de datos de la autoridad SHENA de Brunéi

Safety, Health and Environment National Authority (SHENA), Brunei

A database attributed to Brunei's Safety, Health and Environment National Authority (SHENA) has been posted for download on a breach forum. As a national regulatory body, it likely handles internal staff, inspection and compliance records whose exposure raises government-targeting and phishing risk. Though outside the AR-LATAM focus, government database leaks are worth tracking due to possible downstream supply-chain or credential reuse.

Filtración de la campaña de Philip Morris en Brasil (Cia de Trade)

Cia de Trade / Philip Morris (Brasil)

A 215MB archive tied to a Philip Morris campaign run through the Brazilian firm Cia de Trade has been leaked, including PST mail archives, HR pay stubs and roughly 965 staff credentials. The exposure of internal email and HR records enables targeted phishing, business email compromise and credential reuse against the organization and its partners. Brazilian and regional defenders should force credential resets and review mail exposure.

Filtración de datos de la Alcaldía de Guadalajara de Buga y Hospital Divino Niño

Alcaldía Municipal de Guadalajara de Buga / Hospital Divino Niño (Colombia)

A database combining the municipal government of Guadalajara de Buga (Valle del Cauca, Colombia) and the Hospital Divino Niño has been published on a breach forum. The dump hits a local government and a public hospital, exposing citizen and patient PII including likely health data. Defenders should assess exposure and warn residents of follow-on phishing and identity fraud.

Filtración de 1,5 millones de transacciones de QRIS Indonesia

QRIS (sistema de pagos QR de Indonesia)

A BreachForums thread is distributing what it claims is a database of about 1.5 million QRIS transactions, Indonesia's national QR payment standard used by banks and merchants nationwide. Though outside Latin America, it is a direct example of national payment-rail data being traded openly, which is useful context for defenders of similar systems such as Pix or Mercado Pago. Scale and freshness of the dataset are unverified and should be treated as unconfirmed.

Filtración de datos de RRHH de Philip Morris Brasil

Cia de Trade Philip Morris (Brasil)

A forum post advertises a 215MB archive from Cia de Trade Philip Morris in Brazil containing PST mailboxes, HR paystubs and credentials for roughly 965 staff. If genuine, it hands attackers working corporate email, payroll and identity data to pivot deeper into the Philip Morris environment and to run convincing HR-themed phishing. Relevant for Latin American defenders in the tobacco and industrial sector even though the post date is unconfirmed.

Filtración de base de datos de Altatech (Brasil)

altatech.com.br

A database belonging to the Brazilian company altatech.com.br was posted for leak, exposing the firm's records. Although the post dates to March 2026 and is not fresh, it remains a Latin American corporate breach that could aid credential reuse and targeted phishing. Regional defenders should check for exposed corporate accounts.

Base de datos raspada de Instagram con 17 millones de registros

Instagram

A 17-million-record dataset scraped from Instagram's API in 2026 is being shared. While based on public profile data, at this scale it fuels account enumeration, targeting and credential-stuffing against users and brands. Social-media and brand-protection teams should be aware of the dataset's circulation.

Reclutan infiltrados en bancos, telcos y gobiernos

A buyer is openly recruiting insiders among bank, telecom and government staff, seeking employees willing to provide access or data. Insider recruitment is a precursor to fraud and intrusions against regulated sectors. Defenders in finance, telco and the public sector should reinforce insider-threat monitoring and access controls.

Filtración masiva de datos del partido alemán AfD

AfD (Alemania)

A 281.2 GB archive containing 102,985 files and roughly 400,000 email addresses attributed to the German political party AfD is being advertised. Leaks of political-party data enable phishing of staff and volunteers and can expose internal communications. Though outside Latin America, it is a large, sensitive political leak worth tracking.

Doxxing de miembros del Basij de la Guardia Revolucionaria iraní

IRGC Basij (Irán)

A DarkForums thread shares personal data of Basij members, the volunteer militia tied to Iran's Islamic Revolutionary Guard Corps. The records enable targeted phishing, intimidation and physical risk to identified individuals and their families. It also offers defenders indicators of how Iranian security-force personnel data is being traded in underground markets.

Filtración de datos del consejo regional francés Région Sud

maregionsud.fr (Région Sud, France)

A freshly posted thread leaks a database belonging to zou.maregionsud.fr, a subdomain of the French Provence-Alpes-Côte d'Azur regional council (Région Sud). Exposure of a regional government portal can reveal citizen/administrative records and internal credentials. French public-sector defenders should verify scope and rotate any exposed accounts.

Venta de BigBase: 700 millones de registros de RU, KZ, BY, UA y EE.UU.

BigBase (RU/KZ/BY/UA/US data)

A massive 700-million-record dataset dubbed BigBase, covering Russia, Kazakhstan, Belarus, Ukraine and the US, is circulating on BreachForums. Aggregated personal data at this scale fuels credential stuffing, identity fraud and targeted lookups against named individuals and companies. Only part of it is region-relevant, but the volume makes it a long-term exposure source for defenders.

Código fuente del troyano bancario BTMOB 3.6.3 a la venta

BTMOB (LATAM Android banking trojan)

Complete source code, reseller panel/server code and video tutorials for the BTMOB Android banking trojan are being shared, lowering the bar for new operators to build ATS/overlay campaigns. BTMOB is used against Latin American banks and their customers, so wider availability directly increases fraud risk for Argentine and regional financial institutions. Banks should update mobile-fraud detection for the 3.6.3 build and monitor for new reseller-distributed variants.

Filtración del sistema de vigilancia del IRGC y base de datos policial iraní

IRGC / Iranian police

A BreachForums thread offers a download of data attributed to IRGC surveillance systems and Iranian police databases. If authentic, it exposes law-enforcement personnel records and details of monitoring infrastructure. Such leaks invite retaliatory targeting and are heavily re-shared, so provenance and age should be validated before alerting.

Filtración de la base de datos de la empresa brasileña altatech.com.br

altatech.com.br

A database attributed to the Brazilian company altatech.com.br was posted on the Spear leak forum, with the thread dated March 2026, roughly seven months old. Depending on the schema it may contain customer or employee PII usable for phishing and account takeover in Brazil. Its age limits immediate impact, but it remains a Latin American exposure worth logging.

Ransomware Emperador publica a la brasileña GTL Concreto e Logística

GTL Concreto e Logística LTDA

Ransomware group Emperador listed Brazilian firm GTL Concreto e Logística, which produces concrete and runs logistics and construction operations, claiming to have stolen financial documents, personal and customer data, and employee credentials. The Latin American victim spans manufacturing, finance and transportation, so the leaked data could fuel fraud and further intrusion. Defenders should watch for credential-stuffing and invoice-fraud activity tied to this data.

Reclutamiento de infiltrados en bancos, telcos y gobierno

Sector bancario, telco y gubernamental

A buyer on BreachForums and RaidForums is openly soliciting insiders at banks, telecom operators and government agencies, presumably to obtain privileged access or credentials. The fresh post dated October 19, 2026 signals active demand for insider access to financial, telco and public-sector targets. Defenders in these sectors should tighten insider-threat monitoring and privileged-access controls.

Filtración de la base de datos de Medal.tv con 4 millones de registros

Medal.tv

A 4-million-record Medal.tv dataset is being shared, likely comprising emails and password hashes from a 2024 breach. The data is old but still valuable for credential-stuffing and account-takeover campaigns against users who reuse passwords. Low urgency as an alert, but useful for exposure monitoring.

Base de datos de España filtrada gratis por 'Sophia'

España (entidad sin identificar)

A VIP forum user released a free database attributed to 'Spain' without naming the source organization. If genuine, it exposes the personal data of Spanish residents and could feed fraud and credential attacks. The lack of attribution makes identifying the breached entity the priority.

Base de datos brasileña 'Ouzaz' de 220.000 registros a la venta

Ouzaz (Brasil)

A 220,000-record Brazilian database labeled 'Ouzaz' is being offered on a leak forum. For Latin America it is a regionally relevant exposure that could contain customer PII usable for fraud and account takeover; the source entity still needs verification.