Underground · what matters today

Filtración de diseño y datos técnicos del misil SAAW de India

DRDO / Smart Anti-Airfield Weapon (SAAW), India

A forum post advertises leaked confidential design and technical documentation for India's Smart Anti-Airfield Weapon (SAAW), a precision-guided munition. Disclosure of weapon design data is a defense-intelligence risk that could help adversaries understand and counter the system. Relevant to military CTI and export-control monitoring even though the target is outside Latin America.

Filtración de base de datos presupuestal del CONALEP de México

CONALEP (Colegio Nacional de Educación Profesional Técnica, México)

A threat actor claims to have dumped CONALEP's budget database (28,418 records) together with a compromised national evaluation system of Mexico's national technical-education body. Exposure of budget and evaluation data of a federal education institution can enable fraud, lateral targeting of government systems and impersonation of staff. Mexican public-sector defenders should validate the leak and monitor for credential reuse.

Base de datos del Ministerio de Salud Pública de Ecuador a la venta

Ministerio de Salud Pública de Ecuador

A database attributed to Ecuador's Ministry of Public Health (2025) is being listed on a leak forum, implying exposure of national health data. Government health records are critical infrastructure with high PII value for identity fraud. The post dates to August 2025, so it is not fresh but is worth tracking for LATAM public-sector exposure.

Filtración de 170k pacientes del Hospital Clínica San Agustín (Ecuador)

Hospital Clínica San Agustín, Ecuador

A dataset covering approximately 170,000 patients of Ecuador's Hospital Clínica San Agustín is being offered for sale/leak. Such records typically contain names, IDs and clinical details, creating fraud and privacy risk for patients. The post is from May 2026, so it is stale and not a fresh alert.

Filtración de 120k datos médicos de laboratoriomedicos.com (Ecuador)

Laboratorio Médicos (laboratoriomedicos.com), Ecuador

Roughly 120,000 medical records tied to Ecuadorian medical laboratory laboratoriomedicos.com are offered on a leak forum. The dataset likely includes patient PII and diagnostic data, sensitive under health-privacy rules. The post dates to July 2026, so it is not a fresh alert but remains relevant for tracking LATAM healthcare exposure.

Registro electoral CNE Ecuador: 13,5M votantes y acceso SSH

Consejo Nacional Electoral (CNE) de Ecuador

A seller claims full SSH access to the CNE.GOB.EC electoral registry plus 13.5 million valid voter records for 2026. This is a national electoral authority, so exposure risks mass voter PII, potential data manipulation and integrity attacks ahead of elections. Defenders should urgently verify perimeter/SSH exposure and credential hygiene.

Se buscan datos de Serasa Experian e inmobiliaria brasileña

Serasa Experian

A forum buyer posted a standing request for complete Serasa Experian data plus Brazilian real estate records, indicating continued demand for LATAM credit-bureau and property datasets. It is a demand-side post from August 2025, not a leak, so there is no confirmed exposure of the credit bureau itself. Useful only as context on buyer interest in Brazilian financial and property data.

Filtración inicial de datos de PG Group (Pure Options)

PG Group / Pure Options

The same actor published a first publication batch of samples attributed to PG Group (Pure Options), a US cannabis retail operator. These staged drops typically escalate to a full database release including customer, employee and order data if the target ignores the demand. Impact is limited to a single commercial victim outside the region, but it signals an active extortion campaign worth tracking for tactics and infrastructure.

Filtración inicial de datos de Precision Facades

Precision Facades

A leak actor published a first batch of samples attributed to Precision Facades, apparently a construction/facade contractor, as part of a staged extortion release. Named-victim sample drops usually precede a full data dump if the victim does not engage. The volume and sensitivity are unconfirmed, so treat it as an emerging leak to verify rather than a confirmed large breach.

Venta de acceso de administrador a Vipdestek (Turquía)

Vipdestek.com

A seller posted full administrative access to Vipdestek.com, a Turkish hosting and domain services company, including a multi-page thread with presumed proof. Admin control of a hosting provider can mean control over hosted customer sites, DNS and mail, making it a pivot point for supply-chain style attacks. The post dates from April 2026, so it is not a fresh alert, but the offer may still be live or reused.

Dediserve: publicación inicial de datos filtrados

Dediserve

A leak actor released a first publication batch of sample data attributed to Dediserve, an Irish cloud hosting and IaaS provider. If the samples are genuine, customer records, billing data and hosted-client credentials could be exposed, with downstream risk for every organisation running infrastructure on that provider. Defenders should check the samples for their own credentials and watch for follow-on extortion or access sales.

Comparten una webshell recién subida en foro de hacking

A user on Cracked.st is sharing a 'freshly uploaded shell,' an interactive webshell that gives remote control of a compromised web server. No specific victim or domain is named, so it cannot yet be tied to a known target, but shared shells are often repurposed for defacement, data theft, or as a foothold. Worth monitoring in case the same kit or infrastructure reappears.

Filtración de 1,67 millones de credenciales de España

A 1.67 million-line combolist tagged to Spain (Europa ES) was published on 16 October, aggregating email/password pairs likely from stealer logs and breaches. It is not tied to a single named organization, so the risk is credential reuse across Spanish businesses and public-sector accounts. Monitoring for valid corporate logins and enforcing MFA are the practical defenses.

Datos de más de 750 empresas turcas a la venta o filtrados

750+ Turkish companies

A seller is offering or leaking data attributed to more than 750 top Turkish companies on a leak forum, posted around 17 September 2026. The scope spans hundreds of organizations rather than a single victim, suggesting aggregated corporate contact and credential data useful for phishing and business email compromise. Though outside Latin America, it can seed cross-border fraud targeting regional partners.

Combolist de 205.000 credenciales argentinas a la venta

A 205,000-line Argentina-focused credential combolist was posted minutes ago on a leak forum, likely built from infostealer logs and prior breaches. Rather than one victim database, it lists individual email/password pairs, so exposure is dispersed across consumers and corporate accounts that reuse passwords. Argentine defenders should search SSO and mail gateways for matches and force resets where reuse exists.

Filtración de la base de datos de una universidad nacional francesa

French National University

A free database leak of a French national university has been posted on PwsForums and is available for download to anyone. University breaches expose student, staff and applicant PII such as names, emails and identifiers, which directly fuels phishing and account-takeover campaigns. Although the victim is outside Latin America, it is a real institutional leak worth tracking for credential reuse against related accounts.

Datos del Departamento de Seguridad Nacional de EE.UU. a la venta

U.S. Department of Homeland Security (dhs.gov)

A seller on the DarkForums marketplace is advertising a leaked dataset tied to the dhs.gov domain of the U.S. Department of Homeland Security, offered for sale. Such listings are often scraped credential sets rather than a deep internal breach, but any exposure linked to a cabinet-level security agency warrants verification of credential reuse and account hygiene. Defenders managing government identities should check for matches and force resets on affected accounts.

Ransomware n0n publica a una empresa de salud domiciliaria de EE. UU.

Company #88 (US home healthcare services)

The n0n leak site listed a US home healthcare services provider as victim #88, currently flagged as pending exposure, meaning files may be released shortly. Home healthcare firms hold sensitive patient and billing data, but the victim is unidentified and outside Argentina/LatAm, so regional defender value is limited. Worth a low-priority watch only if the victim is later named or if a LatAm subsidiary emerges.

Redistribución de la base de datos de CAF.fr (22,4 millones)

CAF (Caisse d'Allocations Familiales, Francia)

A 22.4 million-record dataset linked to CAF.fr, France's family-allowance agency, is being reshared via BreachForums. Although the underlying breach is well known and dated 2025, redistribution keeps sensitive social-security data in circulation for reuse in fraud and phishing. It is low priority as a fresh alert but relevant for monitoring data reuse.

Filtración de 6,5 GB de la base de datos del Bank of Saint Lucia

Bank of Saint Lucia

A 6.5 GB database attributed to the Bank of Saint Lucia, a state-linked Caribbean bank, was posted on BreachForums today. The dump could include customer accounts, KYC data, and internal records, exposing clients to fraud and the bank to regulatory and reputational damage. Such data also fuels credential-stuffing and targeted phishing against financial-sector users.

Filtración de la base de datos de Carhartt (91 millones de registros)

Carhartt

A full 91-million-record dump reportedly from US apparel retailer Carhartt is being advertised on DarkForums. The scale suggests customer accounts, emails, and possibly order and payment metadata, which would enable large-scale phishing and credential-stuffing. For defenders it is a major fresh consumer-data breach of a well-known brand.

Base de datos del Gobierno de San Luis (sanluis.gov.ar) filtrada (500k)

Gobierno de San Luis (sanluis.gov.ar)

A 500,000-record database tied to the provincial government of San Luis, Argentina (sanluis.gov.ar), was posted on DarkForums minutes ago. The dump likely holds citizen and administrative records, enabling phishing, identity fraud, and reconnaissance against provincial systems. Leaked PII and any credentials can let attackers pivot into government infrastructure.

Filtración parcial de datos del Ministerio de Salud de Chipre del Norte

Northern Cyprus Ministry of Health

A partial database attributed to the Northern Cyprus Ministry of Health is being circulated under the REICHLeaks banner. As a government health dataset it can contain patient and staff PII useful for targeted phishing, though the partial scope and the entity's small size limit its overall impact. It matters mainly as corroboration of ongoing leaks against regional government health bodies, not as a Latin American alert.

Filtración de base de datos del Ministerio de Salud del Chaco

Ministerio de Salud de la Provincia del Chaco (Argentina)

A full database of Argentina's Chaco Ministry of Health, roughly 2.53 million records, is being dumped on DarkForums, reportedly covering COVID vaccination data from 2020 to 2025. It exposes citizens' identities tied to health records, making it highly sensitive PII protected under Argentine data-protection law. For a defender this signals a confirmed provincial government health-sector breach and a likely phishing/identity-fraud wave against Chaco residents.