Underground · what matters today

Base de datos de monederos cripto de Polonia a la venta

Poland crypto wallets

A seller offers a fresh Polish database of crypto-wallet leads with contact and identity data. Such leads fuel phishing, account takeover and targeted crypto fraud against Polish users. Brands should warn customers and watch for credential-stuffing activity.

Venta de acceso webshell al dominio educativo edu.ua (CCS Education)

edu.ua (CCS Education)

A web shell is for sale for the edu.ua (CCS Education) domain, a Ukrainian education target. This grants persistent remote access to deface, host malware or exfiltrate student and staff data. Education networks should hunt for web shells and patch exposed CMS and plugins.

Venta de acceso webshell a una plataforma de trading Web3 con IA

AI-powered Web3 trading platform

The seller offers a web shell on an AI-powered Web3 automated trading platform, exposing the server and potentially customer funds and API keys. Such access enables data theft, wallet tampering and lateral movement into backend infrastructure. Web3 platforms should audit file integrity and rotate secrets.

Filtración de base de datos de 31 GB del sitio de apuestas Cenabet

Cenabet

A 31 GB database reportedly from the betting site Cenabet is circulating, likely containing account and personal data of gamblers. Large gambling leaks fuel credential stuffing, fraud and extortion against users. Operators should force credential resets and monitor for account reuse.

Venta de acceso webshell a una empresa de lotería y tecnología de Vietnam

Vietnam lottery & technology company

A threat actor is selling webshell access to a Vietnamese lottery and technology company, giving code execution and a persistent backdoor on the victim's web server. Web shells let attackers steal data, pivot into internal networks and deface or ransom the site. Defenders at similar firms should scan for web-shell artifacts and review server logs for unauthorized uploads.

Venta de volcado de datos de clientes de tokentax.co

tokentax.co

A data dump reportedly from the crypto tax platform tokentax.co is being sold, potentially exposing user identities, emails and financial records. This aids phishing, tax-fraud scams and identity theft against crypto users. The provider should assess the breach and notify affected customers.

Venta de datos de usuarios de Trezor y Shipmonk (11.742 registros)

Trezor / Shipmonk

Data for about 11,742 users tied to Trezor and Shipmonk is offered for sale, including names and contact details. It enables highly targeted phishing and social engineering against crypto hardware-wallet users. Affected firms should warn customers and monitor for impersonation campaigns.

Base de datos de 205.000 usuarios de Ledger USA a la venta

Ledger

A database of roughly 205,000 Ledger USA users is being sold, exposing names, emails and contact data of crypto hardware-wallet customers. It enables convincing phishing and identity targeting of high-value crypto holders. Ledger should warn users and defenders should watch for spoofed support scams.

Venta de datos PII de Estados Unidos

A freshly posted thread advertises PII data for the United States, but the description is vague and gives no named victim or record count. Without a confirmed source or scale it is hard to assess impact, and it may be a sample or reseller listing. It is worth a low-priority watch in case the seller later discloses a named organization or a large volume.

Venta de datos personales de 87.000 clientes de Samsung

Samsung

A forum user is offering roughly 87,000 records of personal data allegedly belonging to Samsung customers. If genuine, the set enables targeted phishing and impersonation against affected customers and could be used to abuse account-recovery flows. The scale is moderate, but the Samsung brand makes it a credible lure for fraud, so verification of authenticity is the immediate step.

Base de datos de empresa indonesia con ingresos de +$40M a la venta

Indonesian company (unnamed)

A seller is offering a database tied to a company described as generating over $40M in revenue, suggesting a sizeable corporate data set is on the market. Corporate databases of this kind usually contain customer, employee and financial records that enable fraud, invoice manipulation and targeted phishing against partners. Buyers gaining this data can pivot into the firm's supply chain, so watching for resale is worthwhile even outside the region.

Filtración de base de datos de 399GB de Sociedad Latina

Sociedad Latina

A 399GB database attributed to 'Sociedad Latina' is circulating, a volume that points to a very large collection of personal and possibly financial records tied to a Latin America-linked entity. Leaks of this size typically expose many individuals to identity theft and credential abuse, and often fuel downstream fraud and phishing. Regional defenders should confirm whether their organization's data is contained and prepare notification and monitoring.

Filtración de 9,22M de datos de la Autoridad de Población e Inmigración de Israel

Israel Population and Immigration Authority

A dataset of roughly 9.22 million records attributed to Israel's Population and Immigration Authority is being offered, covering a national population registry. Such data typically includes names, national IDs, dates of birth and addresses, enabling identity theft, impersonation and targeted social engineering at national scale. It matters as a benchmark for how entire civil registries get traded and as a warning for any agency holding comparable citizen data.

Base de datos de la estadounidense Fluke atribuida a ShinyHunters

Fluke Corporation

A database from Fluke, an industrial electrical test-and-measurement manufacturer, is being advertised under ShinyHunters' name. The victim is recovered only from a login-walled thread with no date, so freshness is unconfirmed. Given Fluke's role in industrial and critical sectors, treat it as a plausible supplier-risk exposure and verify independently.

Base de datos de Crunchbase filtrada y publicada en RaidForums

Crunchbase

A dump of business-intelligence platform Crunchbase was posted today, potentially exposing company, funding and contact records for thousands of firms. Such data powers targeted B2B spear-phishing and reconnaissance against the same organizations. Security teams should expect credential stuffing and impersonation built on the leaked contacts.

Filtración de 22 millones de registros de la logística francesa Colis Privé

Colis Privé

A 22-million-record 2025 database attributed to French parcel carrier Colis Privé is being offered on DarkForums, covering customer names, addresses, phone numbers and order details. Posted minutes ago, it fuels phishing, parcel-scam SMS and identity fraud against French consumers. Brand-protection and fraud teams should watch for abuse of the leaked customer set.

Filtración de bases de datos del BCRA, IOMA y GDEBA de Argentina

BCRA / IOMA / GDEBA (Argentina)

Threat actors are circulating a dump linked to Argentina's central bank (BCRA), Buenos Aires health insurer IOMA and the GDEBA state platform, exposing credentials and citizen data. These are core public-sector systems, so the leak enables account takeover, fraud and lateral movement into provincial and national administration. Argentine agencies should treat it as an active exposure and rotate access now.

Ransomware n0n publica al laboratorio dental BladeTech Inc

BladeTech Inc

The n0n group listed BladeTech Inc, a Missouri dental laboratory (CAD/CAM), exposing full patient names, case designs, CNC toolpaths and a 4.4 GB production archive dated September-October 2026. PHI leakage triggers HIPAA obligations and downstream patient privacy risk. Recent production files indicate an active, current compromise.

Ransomware n0n publica a la constructora Xinos Construction (Nueva York)

Xinos Construction Corp

The n0n group published Xinos Construction Corp, a New York construction firm, claiming exposure of employee W-2 forms with SSNs, 2024 partnership tax returns, the QuickBooks Enterprise archive and a state sales-tax audit file. This is highly sensitive PII and financial data enabling tax fraud and identity theft. Small contractors rarely detect such intrusions quickly.

Ransomware Redact publica a Parker-Hannifin Corporation

Parker-Hannifin Corporation

The Redact group listed Parker-Hannifin, a US industrial-machinery manufacturer with ~$21.5B revenue and a significant aerospace/defense supply-chain footprint. A compromise of such a contractor carries downstream risk to defense programs. Manufacturing defenders and their partners should treat this as a live extortion event and watch for data exposure.

Base de datos de 1M de cuentas de Instagram de EE.UU. a la venta

Instagram (US users)

A seller posted roughly 1 million US Instagram credentials/records on a darkweb forum within hours, claiming a fresh database. If genuine it fuels credential-stuffing and account-takeover at scale, though such Instagram datasets are often recycled scrapes. Defenders should force resets and block credential reuse.

Filtración de base de datos del sitio de juegos chino Duowan

Duowan.com

A database for Duowan, a large Chinese gaming and community portal, has been posted for download. Gaming databases usually hold usernames, emails and hashed passwords that feed credential-stuffing attacks. Impact is largely limited to the platform unless reused credentials expose higher-value accounts.

Base de datos de AT&T de 2021 filtrada en un foro

AT&T

A forum thread offers the well-known AT&T 2021 customer database, an old breach that has circulated for years. It contains aging customer PII but is not a fresh incident, so it poses low immediate risk. It is useful mainly as context for credential-stuffing and exposure checks.

Filtración masiva de 5TB con documentos y SSN

A carding forum promotes a free bot offering over 5TB of leaked documents, selfies, SSNs and personal data allegedly from a paid source. This aggregated identity data fuels synthetic identity fraud and account takeover at scale. It is a generic dump with no single victim, so relevance depends on which identities surface.