Underground · what matters today

Filtración de 72 millones de datos fiscales de Brasil

Brasil (datos fiscales/CPF)

A 72-million-record dataset described as Brazilian personal and fiscal (tax/CPF) information is being shared for download. Fiscal identifiers and personal data at this scale fuel identity theft, credit fraud and targeted social engineering across Brazil. Defenders and fraud teams should treat it as a mass PII exposure and monitor for downstream abuse.

Filtración de datos de SIAPA, el agua de Guadalajara

SIAPA (Guadalajara, Jalisco)

A database of SIAPA, the intermunicipal water utility serving Guadalajara and Jalisco, has been leaked, exposing customer and billing records of a critical service. This enables fraud and phishing against ratepayers and targeting of operational staff. Water utilities are high-value targets, so scope should be verified and customers warned.

Filtración de 24 millones de datos confidenciales del SENIAT de Venezuela

SENIAT (Venezuela)

A 30 GB archive allegedly containing 24 million confidential records from Venezuela's SENIAT (national tax authority) was posted on DarkForums, dated 1 June 2026. Though several months old, it exposes taxpayer identity and fiscal data at national scale, a severe risk for fraud and impersonation. Venezuelan and regional defenders should treat it as a confirmed government breach and monitor for downstream abuse.

Base de datos de 20 millones de registros de Buenos Aires filtrada

Buenos Aires (Argentina)

A 7.4 GB dataset attributed to Buenos Aires holding roughly 20 million records was posted on DarkForums only hours ago. The exact source (city or provincial agency, or a private entity) is unclear, but the scale points to citizen or customer PII covering a large share of the population. Argentine defenders should urgently check whether their organization's data is included and prepare containment and notification.

Base de datos completa de jarir.com (27 millones) a la venta

jarir.com (Jarir Bookstore, Saudi Arabia/Kuwait/Qatar)

An actor is selling a purported full database of jarir.com with over 27 million records covering Saudi Arabia, Kuwait and Qatar customers. The scale points to names, contacts, addresses and order history for a major regional retailer, enabling phishing and fraud. Though not AR-LATAM, it is a large commercial leak worth tracking.

Venta de acceso Domain Admin (AD) a empresa SaaS de República Checa

Czech Republic Technology/SaaS company ($100M-$250M)

A seller is offering Active Directory Domain Admin access to a Czech Technology/SaaS company with roughly $100M–$250M revenue, implying full domain control over corporate identities and endpoints. Such access enables lateral movement, ransomware staging and data theft across the entire estate. It is a high-value target worth tracking for acquisition and downstream attack risk.

Filtración de datos de la Milicia Bolivariana de Venezuela

Milicia Bolivariana Nacional (MNB), Venezuela

A threat actor is selling a data dump attributed to Venezuela's Bolivarian National Militia (MNB), a FANB component tied to the Ministry of Defense. Exposure of personnel and operational records of a military body creates counterintelligence and OPSEC risks. Verify the leak's extent and monitor for follow-on targeting of members and their networks.

Brecha de datos de asegurados en Refocus AI y empresas asociadas

Refocus AI / Unique Computing / Gennet.ai

A breach described as fresh exposes insurance policyholder data associated with Refocus AI, Unique Computing and Gennet.ai. Policyholder records typically include names, contact and policy details useful for insurance fraud and targeted phishing. Verify authenticity, as such breach-sale posts are sometimes exaggerated.

Base de datos de subsidios del SEDEM de Bolivia filtrada

SEDEM Bolivia

A dataset tied to Bolivia's SEDEM subsidy program was shared on a leak forum. If authentic, it exposes beneficiary and administrative records of a public social program, useful for fraud, targeting and identity abuse. It is not fresh (posted May 2026) but remains relevant for monitoring Bolivian government exposure.

Base de datos completa de Turknet (2,8M) a la venta

Turknet (ISP, Turquía)

A seller is offering the full Turknet database of roughly 2.8 million records plus other files. Turknet is a major Turkish ISP, so the data likely includes subscriber PII and service details useful for phishing and account takeover. Telecom subscriber leaks also aid SIM-swap and credential-stuffing campaigns.

Base de datos de subsidios de SEDEM Bolivia filtrada en un foro

SEDEM (Bolivia)

A moderator on Spear Leaks posted a database attributed to SEDEM, the Bolivian state entity managing productive and social subsidy programmes. The file appears to include beneficiary data, which is highly exploitable for fraud, impersonation and phishing against vulnerable populations. The post dates from May 2026, so it is not a fresh alert, but it remains relevant to assess structural exposure of Bolivian state programmes.

Filtración de funcionarios del portal sapprende.jalisco.gob.mx

sapprende.jalisco.gob.mx (Gobierno de Jalisco, México)

Officials' names from the Jalisco state government portal sapprende.jalisco.gob.mx were leaked on a dark web forum. Though limited to functionary data, it provides a target list for social engineering and credential phishing against a Mexican state government. Posted minutes ago, it is time-sensitive.

Filtración de datos de Alcaldía de Guadalajara de Buga y hospital Divino Niño

Alcaldía Municipal de Guadalajara de Buga / Hospital Divino Niño (Colombia)

A fresh leak exposes the municipal government of Guadalajara de Buga (Valle del Cauca, Colombia) and the Divino Niño hospital, covering citizen, patient and administrative records. Posted within the last hour, it can fuel phishing and extortion against local public-health services.

Filtración de base de datos RGAE del Ministerio de Finanzas de Guatemala

Ministerio de Finanzas de Guatemala (RGAE)

A threat actor is leaking the RGAE database from Guatemala's Ministry of Finance, containing roughly 130,000 records plus about 235,000 PDF documents. Taxpayer and financial records of a government body make this a high-value exposure for fraud, phishing and identity theft. Defenders in Guatemalan public finance should verify the claim and monitor for downstream abuse.

Ransomware Qilin publica al distrito escolar Llano Independent (EE. UU.)

Llano Independent School District

The Qilin ransomware group has listed Llano Independent School District, a US education victim, on its leak site. Though outside Latin America, a freshly published ransomware victim is actionable for tracking the group's TTPs, affiliates and potential regional spillover. Education sector targeting by RaaS crews continues to rise.

Base de datos de 200.000 clientes de ekiba.de a la venta

ekiba.de

A roughly 200,000-record database of the German company ekiba.de, containing phone numbers and emails, is being sold on the BreachForums marketplace. The scale is modest and limited to contact data, but paired phone and email enables SMS/voice phishing and smishing against customers. A real but low-impact commercial leak rather than a critical-infrastructure or access event.

Combolist VIP de 1,3 millones de credenciales URL:login:password

A contributor released about 1.3 million URL:login:password entries taken from a private VIP section, dated 10/17/2026. The volume is moderate and the content is generic credential material rather than a targeted breach of a specific organization. Still, matched URL:login pairs can seed account takeover attempts, so watch any corporate domains that appear.

Filtración de 75 millones de credenciales URL:login:password

A private, freshly posted ULP dump contains roughly 75 million URL:login:password stealer-log entries dated 18/10/2026. Because stealer logs pair valid credentials with the exact site they unlock, they fuel credential stuffing and initial access against both consumer and corporate accounts. Defenders should assume exposed credentials will be replayed and prioritize password-reset and MFA checks on any matched domains.

Ransomware iah6477 publica a la firma estadounidense McKenneys

McKenneys

Ransomware group iah6477 lists McKenneys, a US professional-services firm, claiming 295.9 GiB of stolen data. It is a fresh victim listing but falls outside the AR-LATAM and critical-infrastructure scope, so its defender relevance is limited to supply-chain awareness. No regional impact is indicated.

Filtración de base de datos de Telekom Serbia con más de 650.000 registros

Telekom Serbia

Forum users are sharing a 650,000+ line database attributed to Telekom Serbia, a national telecom operator. If genuine it exposes subscriber and account data of a critical-communications provider. The post dates to March 2026, so it is not a fresh alert, but it remains useful for historical exposure and password-reuse tracking.

Base de datos de la utility ginebrina SIG a la venta

Services Industriels de Genève (SIG)

A seller in the BreachForums marketplace is offering a database attributed to Services Industriels de Genève (SIG), the Swiss utility that supplies water, electricity, gas and telecom to the Geneva canton. Record count and exposed fields are not disclosed, but any dump of customer or staff data enables targeted phishing and credential abuse against a critical-infrastructure operator. Treat it as an unconfirmed but credible lead for energy/water-sector defenders.

Repost: 3 millones de registros de débito de EE. UU. a la venta

A 3M-record US debit-leads dataset was reposted on BreachForums, dated 31 May 2026. It is a repost of already-circulated financial leads rather than a new breach, limiting its freshness. Still relevant for fraud-monitoring teams tracking exposed cardholder/debit data, but not a new alert.

Filtración de 1,6 GB de registros de stealer del 18 de octubre

A 1.6 GB 'fresh' infostealer log archive dated 18 October 2026 was posted publicly on underground forums. These logs contain browser-saved passwords, cookies and session tokens harvested from infected victim machines. Targets are unnamed and volume is moderate, but exposed session tokens can enable account takeover, so defenders can match their domains against the captured URLs.

Venta de clave API de VirusTotal Enterprise (GTI) con 3M peticiones al mes

A seller is offering a working VirusTotal Enterprise/GTI API key with a 3 million requests per month quota and Retrohunt access. Abuse of such a key lets an adversary quietly test malware against dozens of engines and hunt samples without attribution limits, degrading defenders' detection edge and OPSEC. Security teams should check whether any keys from their tenancy have been leaked or shared.