Underground · what matters today

Ransomware Rhysida publica a la alemana DR.SCHNELL

DR.SCHNELL GmbH & Co. KGaA

Rhysida listed the German manufacturing group DR.SCHNELL with a claimed 2.52 TB / 175,151-file network dump, including Navision/Business Central ERP backups and full HR-payroll data for Germany, Switzerland and Austria. The dataset reportedly holds home addresses, payslips, social-security and tax IDs plus health data, meaning high GDPR and identity-theft risk. Suppliers and partners across DACH should treat this as an active data-leak event.

Filtración de 832 GB de Adobe Magento (business.adobe.com)

Adobe Magento (business.adobe.com)

A forum actor claims to be releasing an 832 GB dataset tied to Adobe's Magento commerce platform (business.adobe.com). If authentic, it would contain merchant, customer or partner records and internal material usable for follow-on fraud and targeted phishing. Volume and brand recognition make this worth verifying quickly for downstream exposure.

Venta de 1 millón de datos de usuarios de Gemini

Gemini (exchange de criptomonedas)

A seller is offering one million 'fresh, untouched' Gemini crypto-exchange leads for sale, potentially exposing KYC or marketing data of US users. If genuine, this is a large customer dataset that fuels phishing and account takeover. Worth tracking for downstream fraud and credential abuse.

Publican base de datos de un ataque en Guatemala

Guatemala (entidad no identificada)

A fresh post on a leak forum offers a 'Guatemala Attack DB', suggesting a database stolen in an intrusion against a Guatemalan organization. The target is not yet identified, so scope and sector (public or private) remain unclear, but regional victims warrant immediate monitoring. Defenders in Guatemala should watch for the sample and attribution.

Base de datos de EsSalud Perú a la venta en foro de filtraciones

EsSalud (Seguro Social de Salud, Perú)

A dark-web actor claims to hold a database for EsSalud, Peru's national public-health insurance agency, and posted it minutes ago. Health-insurer records typically include national ID, medical, and employment data for millions, making this a high-value leak with strong fraud and state-impact potential. Verify the sample quickly and stand up incident response.

Base de datos de 32M de clientes de Wanelo (2018)

Wanelo.com

A database of 32 million Wanelo customer records, dated 2018, is being offered on a forum. Although the volume is large, the data is old and its current operational value is limited. It is useful mainly as a historical reference of exposed customer credentials.

Filtración de datos de México y Perú anunciada en foro

A recent thread announces a leak labeled Mexico-Peru, though scale and impacted organizations are not yet detailed. If confirmed, it affects LATAM entities and exposes credentials or records usable for account takeover. Requires urgent verification and monitoring of leaked accounts.

Ransomware Everest publica a la consultora PwC

PwC

The Everest ransomware group added PwC, the UK-headquartered Big Four professional services firm, to its leak site. A breach of such a high-profile organization that serves governments and enterprises could expose confidential client data and create supply-chain risk. Worth tracking for potential downstream exposure to regional clients.

Venta de +1.000 correos gubernamentales de Venezuela

Gobierno de Venezuela

A seller is offering over 1,000 Venezuelan government email accounts (govmails), posted today. This exposes official credentials of ministries and public entities, enabling targeted phishing, lateral movement and access to state communications. Defenders should monitor login attempts, force credential rotation and enforce MFA across .gob accounts.

PoC de explotación masiva 'php2shell' para vulnerabilidades PHP

A user released a 'php2shell' proof-of-concept claiming mass, bulk exploitation of two PHP vulnerabilities (CVE-2026-109618/CVE-2026-109619) to drop web shells. If functional, it lowers the bar for opportunistic mass compromise of PHP web servers, enabling webshell planting and follow-on intrusion. Defenders should patch exposed PHP stacks and hunt for webshell indicators; source is low-reliability so authenticity is unverified.

Filtración de la base de datos de FFMADRID (ffmadrid.es)

ffmadrid.es

A threat actor posted a database dump attributed to FFMADRID (ffmadrid.es), a Spanish sports entity, dated 22 October 2026. Though record volume is unconfirmed, a leak of a real organization exposes member/personal data and login credentials reusable in phishing and credential-stuffing. Defenders should verify scope, force credential resets and monitor resale of the dump.

Filtración de 1,8 millones de credenciales de Privalia Brasil

Privalia (Brasil)

A seller posted a 1.8 million-row URL:login:password dataset attributed to Brazilian fashion retailer Privalia. The volume of valid credentials enables credential stuffing and account takeover against customers across Brazil and Latin America. Defenders should force password resets and monitor for reused passwords tied to the brand.

InCare Technologies amenazada con publicar datos en 72 horas

InCare Technologies

Actors claim to hold a database from InCare Technologies, a US healthcare-focused managed service provider, and posted a 72-hour countdown before public release. Extortion against an IT provider raises downstream supply-chain risk for its many healthcare clients. Treat as a credible ransomware/extortion alert and notify potentially affected customers.

Filtración de 2,16 millones de registros de la eléctrica SWEPCO

SWEPCO (Southwestern Electric Power Co.)

A 2.16 million-row dataset tied to SWEPCO, a US electric utility, was posted for leak on BreachForums. Exposure of customer and operations-adjacent records for an energy provider merits attention given critical-infrastructure implications. Verify authenticity and monitor for follow-on targeting of utility staff and systems.

Base de datos de empleados de Canada Post (2023)

canadapost.postescanada.ca

A BreachForums post shares roughly 69,860 lines of Canada Post employee data dated to May 2023. Because the records are years old, this is not a fresh alert, but employee credentials can still enable phishing and ongoing account abuse if not rotated. Treat as a stale but useful reference for credential exposure.

Filtración de datos de la eléctrica Entergy Texas

entergy-texas.com

A 176,615-row dataset linked to Entergy Texas, a US electric utility, was posted for distribution. Even a moderate-sized leak of energy-sector customer data can enable targeted phishing and fraud against utility customers. Monitor for use of these records in social engineering against the provider and its users.

Filtración de datos de Coca-Cola con números SSN

cocacola.com

A BreachForums listing offers a cocacola.com dataset of roughly 16,500 rows that includes about 16,000 SSNs. Exposure of SSNs tied to a major corporate brand drives identity theft and targeted social engineering against employees or customers. Smaller in scale but PII-heavy, it is worth monitoring for downstream abuse.

Filtración de base de datos de FFMADRID.ES (España)

FFMADRID.ES

A DarkForums member posted a database purportedly from FFMADRID.ES, a Madrid-based .es entity, in October 2026. Spanish sports/regional organizations hold member and contact data useful for phishing and impersonation. Freshly posted and region-relevant, it merits verification of scope and affected records.

Filtración de datos de pacientes de Good Samaritan Health

gshealth.org

A BreachForums listing offers a gshealth.org patient dataset of about 53,000 rows with over 8,000 emails. Healthcare records are highly sensitive and enable targeted phishing and fraud against patients. Even though it is outside LatAm, a real health provider leak is worth surfacing for cross-referencing.

Filtración de base de datos de SoundCloud de 2,7 GB

SoundCloud

A 2.7 GB database attributed to SoundCloud was posted today as leaked, potentially exposing user account data for a major audio platform. If genuine, it fuels account takeover and phishing against a large global user base. Verify authenticity and monitor for credential reuse among affected users.

Código fuente del sitio del PSOE de España filtrado

PSOE.ES

The source code of the website of Spain's ruling PSOE party was published on a leak forum. Leaked source code can reveal vulnerabilities, hardcoded secrets and logic flaws that enable further attacks on the party's infrastructure. Relevant to Spanish government-adjacent entities; review for exposed keys and exploitable endpoints.

EscapadaRural sufre filtración de 2,9 millones de usuarios

EscapadaRural.com

A 2.9 million-record user database from Spanish rural-tourism platform EscapadaRural is being released on DarkForums, freshly posted in October 2026. It exposes a large base of Spanish consumers including emails and likely credentials, ideal for credential stuffing and phishing. A fresh, sizable leak of a real Spanish org warrants alerting and monitoring for reuse.

Base de datos filtrada del municipio de Salt, Jordania

Salt Municipality (Jordan)

The leaked database of the Salt Municipality in Jordan exposes citizen records from a government body. Local-government data enables targeted phishing and identity fraud against residents and staff, and signals weak security at a public entity; validate the sample and notify authorities.

Brecha de 500.000 registros con SSN y datos bancarios de Kafene

Kafene

Kafene's 2026 breach reportedly exposes 500K+ records with SSNs, banking data, credit scores and KYC documents. This is full identity-theft material (SSN plus financial plus KYC) for US consumers, enabling account takeover and loan fraud; lenders and fraud teams should monitor.