Underground · what matters today

Filtración de 75 millones de credenciales URL:login:contraseña

A fresh 75M-record URL:login:password (ULP) stealer-log dump was posted dated 18/10/2026. Credentials are plaintext pairs usable directly for credential stuffing and ATO across many services. No single org is named, but the scale makes it a prime source for defenders to hunt leaked internal and customer accounts.

Filtración de 2,5 millones de cuentas de usuarios de SpotAngels

SpotAngels

A database attributed to the parking app SpotAngels, roughly 2.56 million user accounts, is being offered as a free download. Such volumes typically include email addresses, password hashes and location or vehicle-related data, which fuel credential stuffing, phishing and physical-location inference. It is a commercial consumer service rather than critical infrastructure and the post appears to be a redistribution, so priority is moderate.

Base de datos de la operadora Asiacell ofrecida en foro de hacking

Asiacell

A hidden-service forum thread advertises a database belonging to Asiacell, one of Iraq's largest mobile operators serving millions of subscribers. The content sits behind a login wall, so scale, fields and authenticity are unconfirmed, but a telecom subscriber dump would expose identifiers, contact data and potentially SIM-related records useful for fraud and account takeover. Telecom leaks also feed SIM-swap and smishing campaigns beyond the country of origin.

A la venta documento interno de SpaceX sobre la constelación Starshield

SpaceX / Starshield

A seller on a carding forum is offering what is described as a SpaceX internal technical baseline and architecture description for the Starshield military satellite constellation. If authentic, it exposes design and capability details of a defense-linked system used by US government customers. Treat it as unverified and likely a scam, but any real leak of this material is relevant to defense and space-sector threat monitoring.

Base de datos del portal gubernamental rss.gov.iq filtrada

rss.gov.iq (Gobierno de Irak)

A full database from the Iraqi government site rss.gov.iq is being distributed, reportedly containing company records, employee identifiers and passport numbers. Exposure of identity documents tied to a state body enables impersonation, targeted phishing against officials and further intrusion into connected services. It is outside Latin America, but it is a genuine government data breach and the same file is being reposted across several forums, so it spreads quickly.

Base de 672k contactos profesionales de Wuzzuf a la venta

Wuzzuf.net

A forum user is selling a 672k-record database of wuzzuf.net, an Egyptian recruitment platform, said to contain emails, phone numbers and user profiles. It is a real, sizable professional-contacts leak useful for phishing and credential-stuffing campaigns. Not region-critical, but a notable PII exposure worth tracking for downstream targeting.

Asociación de Fútbol de Emiratos a la venta: 122 GB filtrados

UAE Football Association

A seller is offering 122 GB allegedly taken from the UAE Football Association, including over 70,000 documents, posted just yesterday. As a national governing body, the trove could hold contracts, member and sponsor records and internal correspondence. Treat it as a serious data sale carrying fraud, impersonation and supply-chain risk.

Filtración de la base de datos de la federación deportiva francesa FSGT

Fédération Sportive et Gymnique du Travail (FSGT)

A database belonging to the French sports federation FSGT has been posted for free download on BreachForums across multiple pages, indicating an active release thread. Such federations hold member registrations, contact details and sometimes payment data, enabling targeted phishing of clubs and volunteers. It is a real organizational leak but outside Latin America and unquantified, so priority is limited.

Fuga de datos y código fuente de las pasarelas turcas payzmoon y payzpool

payzmoon / payzpool (Turquía)

A seller is offering a database leak plus source code for payzmoon and payzpool, two high-risk payment processors operating in Turkey. Exposure of processor source code and transaction data can enable forgery, skimming insight and downstream fraud against merchants and cardholders. It is outside the AR-LATAM focus and unverified, so it ranks low but is worth noting for payment-fraud leads.

Filtración parcial de la base de datos de la librería Cultura (Brasil)

Cultura (Livraria Cultura, Brasil)

A partial database belonging to Cultura, a major Brazilian bookstore/retail chain, has been published on BreachForums for free download with mirrors, so it is already circulating widely. The exact record count is unconfirmed, but partial dumps of this kind typically contain customer names, emails and hashed or plaintext credentials usable for credential stuffing. Brazilian defenders should treat Cultura-linked accounts as compromised and hunt for reuse against corporate and government SSO portals.

Base de datos de Perú, Uruguay y Chile publicada en DarkForums

PE / UY / CL (organización no especificada)

A DarkForums user posted a 'DATABASE' labeled PE, UR, CL minutes ago without naming the source organization. The country codes point to a dump or combolist targeting Peru, Uruguay and Chile that may contain corporate or public-sector credentials. Verification is needed urgently: if .gob.pe, .gub.uy or .gob.cl emails appear, the impact escalates immediately.

Brecha de datos de Getir: 900.000 y 1,2 millones de registros

Getir

A BreachForums post dated October 18, 2026 advertises a Getir breach spanning roughly 900,000 and 1.2 million records across two datasets. The Turkish rapid-delivery firm holds customer PII, delivery addresses and order history, ideal for phishing and account takeover. Defenders should check leaked emails against corporate SSO and watch for credential-stuffing spikes.

Filtración de 7 GB del Gobierno del Estado de Yucatán

Gobierno del Estado de Yucatán (yucatan.gob.mx)

7 GB of data attributed to the yucatan.gob.mx domain was posted on DarkForums minutes ago. The size suggests institutional email, credentials or citizen records, enabling targeted phishing and lateral movement against state systems. A Latin American state government is affected and the post is fresh, so the response window is immediate.

Base de datos de Revolut con datos de tarjetas a la venta

Revolut

A seller is advertising a 'full Revolut database' of roughly 100k lines including credit card data, framed as a 2026 leak. Fintech customer data with card numbers enables card-not-present fraud and account takeover, though the claim is unverified and such ads are frequently recycled or inflated. Fraud and CTI teams should monitor for card BINs and customer records matching this listing before it spreads to carding shops.

SCARLETTGROUP afirma haber comprometido a NBCUniversal

NBCUniversal

The group SCARLETTGROUP posted a breach claim against NBCUniversal on BreachForums dated today, meaning data or samples may already be circulating to buyers. Media conglomerates hold employee, vendor and production data that supports downstream extortion and BEC against partners. Even before verification, this is a fresh public claim that defenders of media-sector entities and their suppliers should triage now.

Filtración de datos de la Secretaría de Educación de Guerrero (SEG)

Secretaría de Educación de Guerrero (SEG)

Documents advertised as belonging to Mexico's Guerrero State Ministry of Education (SEG) are being distributed, reportedly 28k records plus a list of @gob email accounts. Government email directories are high-value for targeted phishing, invoice fraud and lateral movement into education-sector systems. Although the exact posting date is unknown, the size and the .gob mail component make it worth immediate verification by Mexican education authorities.

Filtración de 7 GB de base de datos del Gobierno de Yucatán

Gobierno del Estado de Yucatán (yucatan.gob.mx)

A forum user (Returnero) just published a 7 GB dump attributed to the Yucatán state government domain (yucatan.gob.mx), posted minutes before collection. Government portals concentrate citizen records, internal contacts and employee credentials, so the dump can fuel phishing against state offices and credential stuffing on .gob services. Defenders in Mexican state government should assume exposure and check for credential reuse on VPN, mail and portal accounts.

Brecha total del servidor del regulador bursátil de Turquía (SPK)

Sermaye Piyasası Kurulu (SPK), Turkey

A threat actor claims a full server compromise and root-level data leak of Turkey's Capital Markets Board (SPK), a national financial regulator, including source code. Source and internal data from a government financial authority pose regulatory and supply-chain risk. Although outside LATAM, it is a template worth tracking for how regional financial regulators could be targeted.

Handala publica cuentas de las Fuerzas de Defensa de Israel (IDF)

Israel Defense Forces (IDF)

The pro-Iranian group Handala has published a dataset of Israel Defense Forces (IDF) accounts, posted today. Compromise of military personnel credentials is high-impact for any defense-sector defender, enabling credential stuffing and targeted phishing against government systems. Monitor for reuse of these identifiers in access attempts and impersonation.

Filtración de base de datos del Gobierno de Tucumán (1M de registros)

Gobierno de Tucumán (tucuman.gob.ar)

An actor is distributing a ~1.5 GB database containing roughly 1 million records attributed to the Tucumán provincial government (tucuman.gob.ar). Leaked citizen or administrative data from an Argentine public body enables identity fraud, targeted phishing and abuse of provincial services. Defenders should verify the exposure, scope and which systems/records are involved immediately.

Base de datos de todos los ciudadanos de Bolivia a la venta

Bolivia (registro civil / datos ciudadanos)

A seller on DarkForums claims to be selling a database covering all citizens of Bolivia, posted just hours ago, which would imply a national-scale identity registry exposure (names, national IDs, likely addresses and civil records). If genuine, this is a strategic leak affecting the entire adult population of a Latin American country, enabling mass identity fraud and targeted attacks against public services. Defenders in Bolivian government, banking and telecom should treat it as an active incident and verify against known registro civil/segip records.

Base de datos de 6 millones de clientes de Bouygues Telecom a la venta

Bouygues Telecom

A listing claims a 6-million-record database of French telecom operator Bouygues Telecom is being distributed. Telecom subscriber data (identity, contract, contact and sometimes SIM/line details) is a prime enabler for SIM-swap, smishing and account-takeover campaigns against banking customers. The post has no visible date and may be a repost of older data, so verify before treating it as a new breach.

Filtración de datos de 3.000 estudiantes del portal miravalles.edu.pe

miravalles.edu.pe (Perú)

A forum user posted what is claimed to be a database of roughly 3,000 students from the Peruvian educational site miravalles.edu.pe. Although the scale is modest, student records include names, identifiers and contact details that fuel credential-stuffing and phishing against minors and their families. It is a fresh, verifiable lead worth checking against the institution's own logs.

Filtración de la base de datos de la ARS Meta Salud (República Dominicana)

ARS Meta Salud (República Dominicana)

A fresh dump attributed to ARS Meta Salud, a Dominican health risk administrator, has been posted for free on DarkForums. Health insurers hold member identity data, policy and clinical information that enables fraud, targeted phishing and extortion against patients and providers. Dominican health entities are rarely well monitored, so defenders should hunt for exposure of member records and warn affiliates.