Underground · what matters today

Filtración de archivos del Gobierno de Coahuila, México

Gobierno de Coahuila (México)

A repost of a file/document leak attributed to the Government of Coahuila, Mexico, first surfaced around late 2022. It exposes internal public-sector documents relevant to defenders tracking Mexican government exposure. However, the material is years old, so treat it as historical context rather than a fresh incident.

Volcado de 4,4 millones de registros URL:LOG:PASS a la venta

A 4.4 million line corpus of URL:login:password entries, described as private and UHQ, is being distributed on NulledBB; this format matches infostealer log output rather than a single-vendor breach. Because entries are keyed to specific login URLs, they can be replayed directly against corporate VPN, webmail and SaaS portals. There is no named victim or date, so treat it as background credential-stuffing risk rather than an incident.

Filtración de datos de la turca Tera Group por hacktivistas

Tera Group

A leak-section post published roughly 35 minutes ago claims that data from Tera Group, a Turkish industrial/energy conglomerate, was stolen and released by the 'MLKP Revolutionary Justice Hackers' collective. The thread cites press coverage and is presented as a full data dump, which in hacktivist cases often includes internal documents, email archives and employee information. Even though the victim is outside Latin America, ideologically motivated leaks of critical-infrastructure-adjacent firms frequently seed follow-on intrusion and credential abuse.

Filtración de la base de datos de Westrock Coffee

Westrock Coffee

A forum user published a downloadable database allegedly belonging to Westrock Coffee, a US coffee trading and manufacturing company, under a 2026 tag. The posting is brand new (uploaded minutes ago), so contents and record count are still unverified, but corporate datasets of this type typically carry employee accounts, business contacts and internal operational data. Defenders at food-and-beverage or commodity supply-chain firms should treat it as a potential credential and partner-data exposure and monitor for reuse.

Ransomware bravox publica al bufete estadounidense Barrow & Grimm

Barrow & Grimm

The bravox ransomware group listed Barrow & Grimm, a US litigation law firm, as a victim on its leak site. Law firms hold sensitive client and case data that is attractive for double extortion and downstream attacks. Monitor for related credential and data exposure affecting its clients.

Ransomware bravox publica a la francesa AMSAM (salud)

AMSAM

The bravox ransomware group listed AMSAM, a French healthcare and social-services provider, as a victim on its leak site. Healthcare ransomware threatens patient data and service continuity, making it high-impact for the sector. It is outside Latin America but signals continued targeting of the health and social-care sector.

Hacktivistas filtran datos de la empresa turca Tera Group

Tera Group

The MLKP 'Revolutionary Justice Hackers' announced and leaked data from Turkish company Tera Group. Hacktivist dumps of this kind often include internal documents, employee records and credentials. It is a relevant example of politically motivated data leaks, though outside the Latin American region.

Base de datos del sitio japonés Famm (fotos familiares) a la venta

Famm

A database belonging to Famm, a Japanese family-photo sharing website, is being offered by a forum actor. Such leaks typically expose account details, emails and uploaded media, enabling credential stuffing and privacy harm. Consumer-facing services should check for exposure and force resets.

Filtración de 2,1 GB de datos de la aseguradora Majan Insurance

majaninsure.com

A forum actor posted a 2.1 GB archive allegedly containing leaked data from majaninsure.com, an insurance firm. If authentic it could expose customer PII, policy records and internal documents. Financial and insurance defenders should verify the dump and watch for downstream fraud and credential reuse.

Ransomware Silent Ransom Group publica al bufete Kirkland & Ellis

Kirkland & Ellis LLP

The Silent Ransom Group listed Kirkland & Ellis, one of the world's largest law firms, as a ransomware victim on its leak site. A compromise at this scale threatens highly sensitive M&A, litigation and client data spanning many organizations. It is a high-priority victim even though it sits outside Latin America.

Akira publica a la editorial Bethany Press

Bethany Press International

Akira claims Bethany Press International, a Christian book publisher and distribution services firm, and says it will upload 40GB of corporate data. The claimed material includes employee financial and personal records, customer information, financials and contracts. It is a mid-size US victim, so it ranks below regional incidents but illustrates the ongoing exfiltration pattern.

Akira publica a la alemana Medienwerkstatt

medienwerkstatt ag

Akira added medienwerkstatt ag, a Thurgau-based media and communications provider in the education sector, threatening to release 130GB of corporate data including employee personal information. The volume of exfiltrated HR and client material makes follow-on phishing and business email compromise likely. It is a European victim, so relevance for LATAM defenders is contextual rather than direct.

Akira publica al laboratorio de patología Annapath

Annapath, Inc.

Akira claims Annapath, a surgical and cytopathology laboratory serving Maryland, Delaware, Pennsylvania, DC, Virginia and West Virginia, and threatens to publish 110GB of corporate data. Healthcare diagnostics providers hold sensitive patient and partner data, so the leak would expose clinical relationships and business records. Although outside Latin America, the playbook (VPN/credential abuse against mid-size providers) mirrors regional targets.

Base de datos de Budigadai.com a la venta por 5.000 USD

BUDIGADAI.COM

A seller is offering a 1.7 GiB SQL dump of Budigadai.com for 5,000 USD, a modest-sized database of unclear business importance. No sample or record count is provided, so impact is hard to assess. Worth noting only for credential-reuse and brand-abuse tracking.

Base de datos del vietnamita Moon.vn a la venta

Moon.vn

A fresh post offers a database belonging to Moon.vn, a Vietnamese online education platform. Account, email and possibly enrolment data of students would be at risk if the dump is genuine. It is regionally relevant only to APAC defenders but signals continued targeting of education portals.

Publicado exploit masivo php2shell (CVE-2026-109618/109619)

A forum user posted a PoC tool ('php2shell') for mass exploitation of two recent vulnerabilities, CVE-2026-109618 and CVE-2026-109619, described as a bulk exploit. Public tooling for a fresh CVE sharply shortens the window before opportunistic scanning and web-shell deployment hits PHP-based public sites. Defenders running exposed PHP applications, common in government portals and telco/banking web fronts, should check patch status now.

Ransomware Qilin publica a la española Airtificial

Airtificial

The Qilin group has added Airtificial, a Spanish engineering and robotics technology company, to its leak site. No file listing is shown yet, so the scope of exfiltrated corporate, client or project data is unconfirmed. As a listed Spanish supplier to industrial and public-sector programmes, its compromise can expose partner data and OT/engineering information.

Ransomware Rhysida publica a la alemana DR.SCHNELL

DR.SCHNELL GmbH & Co. KGaA

Rhysida listed the German manufacturing group DR.SCHNELL with a claimed 2.52 TB / 175,151-file network dump, including Navision/Business Central ERP backups and full HR-payroll data for Germany, Switzerland and Austria. The dataset reportedly holds home addresses, payslips, social-security and tax IDs plus health data, meaning high GDPR and identity-theft risk. Suppliers and partners across DACH should treat this as an active data-leak event.

Filtración de 832 GB de Adobe Magento (business.adobe.com)

Adobe Magento (business.adobe.com)

A forum actor claims to be releasing an 832 GB dataset tied to Adobe's Magento commerce platform (business.adobe.com). If authentic, it would contain merchant, customer or partner records and internal material usable for follow-on fraud and targeted phishing. Volume and brand recognition make this worth verifying quickly for downstream exposure.

Venta de 1 millón de datos de usuarios de Gemini

Gemini (exchange de criptomonedas)

A seller is offering one million 'fresh, untouched' Gemini crypto-exchange leads for sale, potentially exposing KYC or marketing data of US users. If genuine, this is a large customer dataset that fuels phishing and account takeover. Worth tracking for downstream fraud and credential abuse.

Publican base de datos de un ataque en Guatemala

Guatemala (entidad no identificada)

A fresh post on a leak forum offers a 'Guatemala Attack DB', suggesting a database stolen in an intrusion against a Guatemalan organization. The target is not yet identified, so scope and sector (public or private) remain unclear, but regional victims warrant immediate monitoring. Defenders in Guatemala should watch for the sample and attribution.

Base de datos de EsSalud Perú a la venta en foro de filtraciones

EsSalud (Seguro Social de Salud, Perú)

A dark-web actor claims to hold a database for EsSalud, Peru's national public-health insurance agency, and posted it minutes ago. Health-insurer records typically include national ID, medical, and employment data for millions, making this a high-value leak with strong fraud and state-impact potential. Verify the sample quickly and stand up incident response.

Base de datos de 32M de clientes de Wanelo (2018)

Wanelo.com

A database of 32 million Wanelo customer records, dated 2018, is being offered on a forum. Although the volume is large, the data is old and its current operational value is limited. It is useful mainly as a historical reference of exposed customer credentials.

Filtración de datos de México y Perú anunciada en foro

A recent thread announces a leak labeled Mexico-Peru, though scale and impacted organizations are not yet detailed. If confirmed, it affects LATAM entities and exposes credentials or records usable for account takeover. Requires urgent verification and monitoring of leaked accounts.