Underground · what matters today

Filtración del código fuente privado de McDonald's

McDonald's

The post shares what it claims is McDonald's private source code, potentially exposing internal APIs, authentication logic, and hardcoded secrets. If authentic, it hands attackers a roadmap to backend weaknesses across McDonald's global and Latin American operations. Validate authenticity before alerting.

Base de datos de 720.000 usuarios de la plataforma Zwjate a la venta

Zwjate.com

Threat actors are selling a database of roughly 720,000 users of Zwjate.com, an online marriage and matchmaking platform based in Saudi Arabia. The records likely contain personal and contact details useful for phishing, romance fraud and account takeover. It is a sizable regional consumer-data sale but lies outside Latin America, so operational impact for AR/LATAM defenders is limited.

Filtración de 5,8 TB de documentos confidenciales del puerto mexicano PSI

Mexico Smart Secure Port (PSI)

Actors are circulating an alleged 5.8 TB trove of 16.5 million confidential documents from Mexico's Smart Secure Port (PSI) authority. Port internal data is critical-transport infrastructure, exposing operations to espionage, fraud and follow-on intrusion. The post dates to early 2026 and is not a fresh alert, but it remains a major LATAM critical-infrastructure leak worth tracking.

Base de datos de clientes de Picnic Países Bajos a la venta

Picnic Netherlands

A threat actor is selling a customer database belonging to Picnic, a major Dutch online supermarket, in a post from the last day. Though outside LATAM, a fresh leak from a large grocery delivery platform exposes consumer PII and order data, enabling phishing and fraud. EU partners and the affected users should be notified promptly.

Base de datos con 109.000 víctimas mexicanas a la venta

A seller is offering a database of roughly 109,000 Mexican victims, likely credentials or PII harvested from breached services. Mexico is a priority LATAM market, and mass national victim data fuels account takeover and fraud against local users and organizations. Defenders should hunt for credential reuse and watch for downstream phishing campaigns.

Correo oficial de la telco chilena VTR Comunicaciones filtrado

VTR Comunicaciones

A post claims the official email account of Chilean telecommunications operator VTR Comunicaciones was leaked, a critical-infrastructure-adjacent target. The scope appears limited and the post looks older, so it is lower urgency, but telecom email compromise can enable business email compromise and lateral abuse. Worth noting for defenders tracking Chilean telecom exposure.

Brecha en el Ministerio de Finanzas de Afganistán, 1,4 TB filtrados

Afghanistan Ministry of Finance

A post claims a complete infrastructure breach of the Afghanistan Ministry of Finance with 1.4 TB of data leaked. If genuine, this is a massive government exposure affecting financial records and systems, useful for tracking state-actor and hacktivist targeting. The exact date and authenticity are unconfirmed due to a login wall.

Base de datos del Poder Judicial de Honduras (488k registros) a la venta

Poder Judicial de Honduras

A threat actor has posted a database allegedly belonging to the Judicial Branch of Honduras (gob.hn), containing about 488,000 records, and the listing appears fresh. Judicial data can include case parties, identities and contact information highly valuable for fraud, doxing and pressure on officials. This is a direct hit on a Latin American government institution and warrants immediate validation.

Filtración de base de datos con 1M de ciudadanos de Río Negro

Provincia de Río Negro

A 2 GB dataset claimed to contain data on roughly one million citizens of the Argentine province of Río Negro is being released, attributed to multiple collaborators. Provincial citizen databases typically hold DNI, contact and address details useful for identity fraud, phishing and targeted attacks against public services. Defenders in Argentine government should treat this as a live exposure and verify scope.

Base de datos de la plataforma surcoreana Karrot a la venta

Karrot (Danggeun Market)

A seller is offering a database tied to Karrot, South Korea's large second-hand marketplace with tens of millions of users. If genuine, the dataset would contain user PII at significant scale, useful for fraud and credential abuse. It is outside the LATAM region but a sizable real-org leak worth validating.

Base de datos de la fintech estadounidense Dave filtrada para descarga

Dave Inc

A downloadable database attributed to Dave, a US fintech/banking app with millions of customers, has been posted for free download. Such a leak typically exposes customer PII and financial details, enabling fraud, account takeover and phishing. Defenders in financial services should verify the authenticity and scope of the exposure.

Base de datos de Miruasia/Kandora filtrada

Miruasia / Kandora

A PwsForums thread advertises a database belonging to the Asian drama streaming platforms Miruasia/Kandora, likely exposing customer account records; the size is unconfirmed behind the paid section. Not tied to AR-LATAM government or critical infrastructure, so relevance is limited, but credential reuse could affect linked downstream accounts for defenders.

Venta de leads de clientes bancarios de México en foro

Bancos de México

A forum thread offers lead lists tied to Mexican bank customers, likely contact/PII data usable for phishing, vishing and account-takeover campaigns against retail banking users. The scale is unspecified and appears to be curated marketing leads rather than a full breach. It is regional and bank-sector relevant, but dated August 2024, so it is stale and should be treated as background context, not a fresh alert.

Filtración de archivo de proyecto del Cuerpo de Ingenieros del Ejército de EE. UU.

US Army Corps of Engineers (USACE) - Hull 230 MCHD

A forum user posted an archive of project documents belonging to USACE (Hull 230 MCHD) today, 19 October 2026. The exact volume is unclear from the thread, but military engineering/contract documentation can expose internal infrastructure layouts and contractor identities. Defenders supporting USACE-linked projects should verify the exposure and watch for credential reuse against related portals.

Venta de acceso de administrador al centro educativo búlgaro Kindyroo

kindyroo.bg

A seller claims to have administrative and database-level access to kindyroo.bg, a Bulgarian early-education center. The target is small and outside Latin America, so regional impact is minimal, but the offer illustrates a live web-facing access sale that could be reused against franchise or partner infrastructure. No evidence of government or critical-infrastructure involvement was found in the post.

Base de datos de FireColombia publicada en un foro

FireColombia

A freshly published thread offers a database attributed to FireColombia, an emergency/fire-response related Colombian organization, posted within minutes of collection. Emergency-service data can expose internal contacts, personnel and operational details useful for social engineering or disruption. Colombian emergency and public-safety bodies should confirm the scope of the leak and treat any exposed credentials as compromised.

Filtración de empleados de la Secretaría de Educación de Guerrero (SEG)

Secretaría de Educación de Guerrero (SEG), Mexico

A forum actor is distributing what is advertised as a database of more than 70,000 employee records belonging to Guerrero State's Ministry of Education (SEG) in Mexico. Public-sector payroll and staff data enables targeted phishing, credential stuffing against government portals and identity fraud against civil servants. Mexican state entities should verify exposure of SEG accounts, force resets and watch for follow-on intrusion attempts.

Base de datos de la fintech Blend.com a la venta en un foro

Blend.com

A Cracked.st seller is advertising a 'HQ database' of blend.com for sale, with a duplicate thread claiming freshly dumped data. Blend provides lending and account-opening software used by US banks and mortgage lenders, so any real dataset could carry customer PII and loan application data. The post date and record count are unverified, so validate sample data before alerting downstream financial-sector partners.

Base de datos de PetroEcuador/PetroAmazonas expuesta en BreachForums

PetroEcuador / PetroAmazonas (EP Petroecuador, Ecuador)

A BreachForums user posted a download thread claiming an exposed database belonging to PetroEcuador/PetroAmazonas, Ecuador's state-owned oil and gas operator. Scale and exact contents are not confirmed in the listing, but a leak affecting a national energy company can expose employee credentials, internal systems and supplier data used by operational technology. Defenders in Ecuadorian energy should treat this as a possible precursor to intrusion or extortion and hunt for credential reuse.

Filtración de la base de datos del Ministerio de Salud de Ruanda

Rwanda Ministry of Health

A forum thread advertises a leaked database attributed to the Rwanda Ministry of Health, a government health authority dealing with sensitive citizen data. Content sits behind a login wall, so scale and date are unknown, but a government health database leak is high-impact. Worth monitoring despite being outside AR/LATAM.

Filtración de base de datos de la utility AES Indiana (3,2M filas)

AES Indiana

A BreachForums post offers a database for aesindiana.com, a US electric utility, reportedly containing about 3.28 million data rows and 328,263 email addresses. Utilities are critical infrastructure, making exposure of customer/operational emails valuable for phishing and BEC. Even outside LATAM, this is a large dataset tied to a real critical-infrastructure operator and deserves review.

Filtración de código fuente y datos de SmartGPS (Brasil)

SmartGPS

A DarkForums thread advertises leaked source code and data from SmartGPS, a Brazilian GPS/tracking service (smartgps.com.br). The post is dated January 2026, so it is roughly nine months old and not a fresh alert. Still relevant for LATAM defenders given tracking/telemetry data and code exposure, but low urgency now.

Paquete privado de 75 millones de credenciales ULP a la venta

A seller is offering a private 75-million-line URL:LOGIN:PASSWORD stealer-log bundle dated today, indicating very large fresh credential exposure. It is not tied to a single named victim but fuels credential stuffing against web logins across many organizations. Defenders should treat it as a fresh corpus for password-reuse and session-hijack risk, and prioritize MFA and credential resets.

Filtración de 650.000 registros del proveedor peruano Hosting Perú

Hosting Perú (hostingperu.com.pe)

A dump claiming more than 650,000 records from the Peruvian hosting provider Hosting Perú is being distributed on DarkForums. Hosting providers aggregate customer accounts, support tickets and possibly billing and credential data, so the blast radius extends to every client hosted on the platform. Peruvian businesses and public-sector sites hosted there should rotate credentials and check for reuse; the post date is not evident in the thread, so recency must be confirmed.