Underground · what matters today

Filtración de datos del Ministerio Coordinador de Asuntos Económicos de Indonesia

Coordinating Ministry for Economic Affairs (Indonesia)

A database attributed to Indonesia's Coordinating Ministry for Economic Affairs surfaced on a dark web forum within hours of posting. Government ministry records can contain officials' and citizens' PII and internal contact data. If authentic, it raises targeted-phishing and intelligence-collection risks against a national economic body.

Base de datos de Turkish Airlines filtrada o a la venta

Turkish Airlines

A seller is offering a database attributed to Turkish Airlines, a major international carrier, on a dark web forum. Airline databases typically hold passenger PII, booking and loyalty data that fuel phishing and fraud. Verification is warranted given the target's size and travel-sector exposure.

Filtración de datos de 1 millón de usuarios de Bank of America

Bank of America

A threat actor claims to have leaked data on roughly one million Bank of America customers, exposing personal and financial identifiers. If genuine, this volume of PII enables phishing, account takeover and fraud at scale. Financial-institution fraud teams should validate and monitor for downstream abuse.

Ransomware n0n publica a la clínica EnVision Eye Care

EnVision Eye Care

Ransomware group n0n published US ophthalmology practice EnVision Eye Care, exposing 13,308 patient records with names and dates of birth plus the full 2018-2025 database backup and eye-scan archive. Healthcare data of this depth fuels medical identity theft and extortion. It reflects the ongoing healthcare ransomware wave, though the victim sits outside Latin America.

Filtración de datos personales de la aerolínea Garuda Indonesia

Garuda Indonesia

A threat actor is advertising a PII dataset allegedly belonging to Garuda Indonesia, the state-owned national airline. Passenger and staff personal data from a national carrier is sensitive because it enables targeted phishing, identity fraud and social engineering against travellers and employees. Defenders should watch for credential-stuffing and impersonation campaigns leveraging airline data.

Filtración de la base de datos de Groupe MBM (Francia)

Groupe MBM

A database for groupe-mbm.com, a French company, is being offered in a leaks section, dated mid-2026. It is a mid-sized corporate data leak rather than a critical-infrastructure event. Still relevant for fraud and phishing monitoring of the affected organization and its partners, though not urgent outside Europe.

Filtración de 200 millones de credenciales de X (Twitter)

X (Twitter)

A dump claiming 200 million email:password pairs for X (Twitter) is being posted, but the 2025 dating and repeated recycling of this dataset suggest it is largely stale credential-stuffing material. It still fuels account takeover and credential-stuffing against any service where users reused passwords. Defenders should focus on password reuse detection rather than treating it as a new breach.

Base de datos de clientes del banco Desjardins publicada gratis

Desjardins Bank

A full customer database attributed to Desjardins Bank is being released for free, removing any paywall that would limit abuse. Banking data of this kind enables account takeover, phishing and SIM-swap attacks against customers. Defenders at financial institutions should treat it as evidence of credential exposure even if the data is a re-upload of an earlier breach.

Filtración de 11,5 millones de datos de México (1,36 GB)

Datos de México

A 1.36 GB dataset claiming 11.5 million Mexican records is being circulated on a carding forum. Given the scale and the LATAM victim base, it likely contains personal and financial identifiers usable for fraud and identity theft. This matters for Mexican banks, telcos and public entities that must assess exposure and warn affected users.

Filtración de datos de Fluke Corporation por ShinyHunters

Fluke Corporation

ShinyHunters is advertising a data leak of fluke.com, a US industrial electrical test-and-measurement manufacturer widely used in critical infrastructure and energy sectors. The group is a high-profile actor, so any release tied to them tends to be real and usable for follow-on intrusion. Defenders in OT/energy supply chains should watch for credential reuse and phishing against Fluke-linked accounts.

Ransomware pear publica a Solar Communications

Solar Communications International

The 'pear' ransomware group has listed Solar Communications International, a US supplier of wireless-infrastructure products, as a victim. Telecom and wireless-infrastructure suppliers are sensitive targets given downstream dependencies. Defenders in telecom supply chains should note the claim and monitor for leaked data.

Ransomware pear publica a Macfarlan Capital Partners

Macfarlan Capital Partners

The 'pear' ransomware group has published Macfarlan Capital Partners, a US real estate investment firm serving institutional and high-net-worth investors, as a victim. Financial services victims face data theft and extortion with regulatory consequences. Though outside Latin America, it indicates an active extortion campaign.

Venta de exploit zero-click para iOS y Android

A seller is offering a zero-click exploit chain affecting iOS 13 through 26.4.2 and Android 7 through 17, which, if real, allows remote compromise without user interaction. Such capability is high-value for targeted surveillance and espionage against mobile devices. Defenders should treat this as a potential unpatched mobile threat.

Base de datos de clientes de Triglav Serbia (525k registros)

Triglav Serbia

A seller is offering a 525,000-record customer database allegedly belonging to Triglav, a Serbian insurer, and has posted a sample. If genuine, it exposes policyholder names, contact and policy data, enabling phishing and identity fraud. Fresh database leaks are often reused in follow-on attacks, so the sample should be validated.

Filtración de código fuente de los repositorios de Yandex

Yandex

A thread claims to offer Yandex git repository source code, from a major Russian technology and search provider. If authentic, source code exposure can reveal internal systems, secrets and vulnerabilities. The posting is recent and should be validated before assumptions about impact are made.

Venta de acceso root a un servidor no identificado

An actor is advertising root access to an unnamed server for sale. No victim organisation, country or access type is specified, which limits its immediate investigative value, but root access sales frequently precede ransomware or data theft. Monitoring the seller may reveal the target during negotiation.

Filtración de datos del Instituto de Tecnologías Espaciales de Pakistán

Institute of Space Technologies Pakistan

A threat actor claims to have leaked data belonging to Pakistan's Institute of Space Technologies, a government-linked space and defence research body. The posting is fresh (under an hour old) and offers the dataset for download, potentially exposing personnel, research or project data. Defenders tracking state-adjacent aerospace targets should verify scope and monitor for downstream reuse.

Ransomware Bravox publica a la alemana Minkon

Minkon

Bravox ransomware has listed German metallurgical firm Minkon as a new victim on its leak site. Fresh ransomware publications signal active intrusion and data theft at the target. It is lower priority for LATAM but relevant when tracking emerging ransomware activity.

Base de datos nacional de ciudadanos de Pakistán filtrada

Pakistan

A national citizenship database of Pakistan is being offered for download, affecting a population of hundreds of millions. Bulk national ID data powers identity theft, loan fraud and impersonation at scale. It is notable for teams tracking large state data leaks.

Filtración de 22,4 millones de registros de CAF.fr

CAF.fr

A 22.4M-record dataset from CAF.fr, the French family benefits administration, is being circulated and dated 2025. It contains personal and benefits data of French residents, ideal for fraud and social engineering. Government benefits data leaks carry high privacy and fraud risk.

Filtración de 20 millones de registros de clientes del ISP francés Free.fr

Free.fr

A 43.5GB dataset of around 20 million Free.fr customer records is circulating, a major French telecom data leak. Telecom customer data enables SIM-swap, phishing and account-takeover campaigns. Free is critical infrastructure, so this matters well beyond France.

Base de datos de ciudadanos de Ucrania (53 millones) filtrada

Ukraine citizenship database

A database of roughly 53 million Ukrainian citizens is being offered, which if authentic is among the largest national identity leaks seen. Bulk citizen data drives identity fraud and targeted scams against Ukrainians. It is significant for any team tracking large government data leaks.

Base de datos interna de Uber (uberinternal) con más de 20 millones de registros

Uber

Threat actors are advertising an internal Uber dataset (uberhub.uberinternal.com / MDM) of over 20 million records. Internal corporate data at this scale enables account takeover and targeted social engineering against employees. Leaks like this are often repurposed to fuel further intrusions.

Base de datos del Ministerio de Defensa de Israel a la venta

Israel Ministry of Defense

A dataset attributed to the Israeli Ministry of Defense is being offered on the forum, which if genuine would expose sensitive defense personnel or systems data. Offers like this fuel state-level targeting and credential abuse. Defenders should monitor for credential reuse and linked access sales.