Underground · what matters today

Filtración de datos de 6,3 millones de clientes de Bouygues Telecom

Bouygues Telecom (France)

A 6.3 million-record database of Bouygues Telecom customers is posted for release, including citizen data. As a major French telecom, the leak exposes subscriber PII usable for phishing and SIM-swap fraud; verify the sample and warn the carrier and its customers.

Filtración de 5,8 TB de documentos confidenciales de puerto mexicano (PSI)

Mexico Smart Secure Port (PSI)

A 5.8 TB set of about 16.5 million confidential documents tied to Mexico's Smart Secure Port (PSI) is offered on DarkForums. Port and logistics records expose cargo, customs and personnel data, a high-value target for fraud and physical security; the post dates to early 2026, so treat as stale but still sensitive.

Filtración de bases de datos de COFEPRIS, Hospital Ángeles y RappiPay

COFEPRIS / Hospital Ángeles / RappiPay (México)

A batch of Mexican databases is circulating, including COFEPRIS (the federal health regulator), Hospital Ángeles, Bienestar Salud and fintech RappiPay. These hold patient, regulatory and financial records; if genuine they expose sensitive health and government data and should be prioritized for validation and credential-reset checks.

Filtración de datos del minorista francés LDLC

LDLC

A '[FR] LDLC leak' thread dated 19 Oct 2026 claims leaked data from French electronics retailer LDLC. Retail customer databases enable credential stuffing and targeted phishing against a large consumer base. Scale is unverified; validate the dump and check for overlap with prior breaches.

Filtración de datos de la hipotecaria New American Funding

New American Funding

A 'New American Funding leak' thread dated 19 Oct 2026 claims a data breach at the US mortgage lender. Such dumps typically contain borrower PII and financial details useful for fraud and social engineering. Scale is unconfirmed; verify the sample and record count before alerting downstream teams.

Datos filtrados de Boeing.com a la venta

Boeing

Data attributed to Boeing.com is being shared, a major aerospace and defense contractor. Even a partial leak can expose employee accounts, supplier or internal documents that aid targeted attacks and supply-chain risk; confirm scope and hunt for related credential reuse.

Base de datos de Vodafone publicada en foro clandestino

Vodafone

A thread titled 'VODAFONE DATABASE' posted 19 Oct 2026 presents a dataset allegedly belonging to telecom giant Vodafone. If authentic, subscriber and account data from a critical-infrastructure operator could be exposed for abuse. Details and scale are unverified; treat as a possible repost and validate before acting.

Filtración completa de datos del operador neerlandés Odido

Odido

Thread '[NL] Odido Full leak' posted 19 Oct 2026 offers what is claimed to be a complete data leak from Dutch telecom Odido. Telecom operators are critical infrastructure; a full leak could expose subscriber PII that fuels phishing and SIM-swap attacks. Verify authenticity and scale, as this may be a repost of the 2024 breach.

Base de datos del banco brasileño bcdbank.net comprometida

bcdbank.net

Actor 'bypassar' claims Brazil's bcdbank.net was hacked and its database dumped for download on BreachForums. If genuine, customer PII and financial records of a Latin American bank could be exposed, enabling fraud and account takeover. As a regional financial entity (critical infrastructure), this warrants urgent verification and credential-exposure monitoring.

Base de datos de la Agencia Nacional de Innovación de Tailandia a la venta

National Innovation Agency (NIA), Thailand

A threat actor is advertising a database belonging to Thailand's National Innovation Agency, a government body, on DarkForums. The post does not state record counts or a sample, so scope is unconfirmed, but any government dataset of this kind typically carries staff contacts, project and grantee information. It matters mainly as an indicator of regional government targeting and for any LATAM partners with joint innovation or funding programs.

Filtración de base de datos del Gobierno de Santa Fe (3M de registros)

Gobierno de la Provincia de Santa Fe (gob.ar)

A 2.5GB database allegedly containing roughly 3 million records from the Santa Fe provincial government (santafe.gob.ar) has been posted for free on DarkForums. This is a public-sector entity in Argentina, so exposed citizen data likely includes DNI, CUIT, addresses, contact details and possibly credentials usable for phishing or lateral access to provincial services. Defenders should verify the claim against provincial portals, force credential resets on exposed accounts and monitor for re-use of the data in fraud campaigns.

Ransomware lamashtu publica a la constructora alemana Hecker Holzsystembau

Hecker Holzsystembau

The lamashtu ransomware group has listed German timber-construction firm Hecker Holzsystembau as a victim, meaning stolen data is likely being extorted or released. Leaked corporate files can expose client contracts, project plans and internal credentials used for supply-chain and phishing attacks. The victim is outside Latin America, so this is context rather than a regional alert.

Filtración de base de datos de la empresa estadounidense Bay Alarm

Bay Alarm

A forum listing advertises a database belonging to US alarm/security company Bay Alarm, a named organization whose systems tie into customer premises and monitoring. Such data can expose client PII, account details and physical-security relationships, aiding targeted phishing or fraud. It matters to the named victim primarily; regional relevance is low unless the leak includes LATAM customers.

Reventa de acceso root a una gran empresa a la venta

A seller is re-selling root-level access to a large enterprise server, indicating a full-system compromise already obtained. Root access lets an intruder persist, steal data, deploy ransomware or resell further, making this a serious initial-access offering. Though the victim is unnamed and the post locked, root footholds to sizable organizations are rare and worth monitoring.

Acceso SSLVPN a una gran corporación a la venta

A forum listing advertises SSL VPN access to a large corporate network, a classic initial-access vector for ransomware and espionage actors (VPN appliances are frequently the entry point in recent intrusions). While the target is unnamed and the post is login-walled, a live corporate SSLVPN foothold is high-value and time-sensitive; if the buyer is regional this could be significant. SSLVPN access combined with valid credentials quickly enables internal reconnaissance and domain compromise.

Venta de acceso al panel OrangeHRM de International Tax Technical Center

International Tax Technical Center

A seller is offering administrative access to the OrangeHRM HR platform of International Tax Technical Center. HR systems typically hold employee PII, payroll data and internal credentials, making this a viable foothold for lateral movement and data theft. Buyers could harvest identity data to target staff or pivot deeper into the organization.

Posible filtración de datos de clientes de Movistar Perú

Movistar Perú

A fresh post on a leak forum titled 'MOVISTAR PERU' appears to share a customer database or credential combo tied to the Peruvian telecom operator. Telecom is critical infrastructure in Latin America, so exposed subscriber data or credentials could fuel SIM-swap, account takeover and downstream attacks on banking and government services. Defenders at Movistar and regional CERTs should validate the corpus and force resets if matched.

Ransomware Everest publica a la firma legal Linebarger Goggan Blair & Sampson

Linebarger Goggan Blair & Sampson

The Everest ransomware group has listed Linebarger Goggan Blair & Sampson, a US law firm that specializes in delinquent tax collection for municipalities, counties and school districts across multiple states. Such a breach could expose sensitive personal and financial data of citizens and public-entity clients, plus potentially disrupt government revenue processes. Though outside the AR-LATAM region, the public-sector data exposure warrants monitoring for downstream targeting.

Venta de acceso completo a Claro Perú

Claro Perú

A forum user registered in October 2026 is advertising 'full access' to Claro Peru, a major telecommunications operator tied to national connectivity and critical infrastructure. A claimed full-access sale to a LATAM telecom could expose subscriber data, internal systems or network controls, enabling fraud, lateral movement or service disruption. Given the account is brand new and the post is fresh, defenders at Claro and regulators should treat it as a high-priority lead and verify scope immediately.

Comunicado sin identificar en la sección de bases de datos filtradas de DarkForums

A brand-new Spanish-language 'COMUNICADO' was posted (about 3 minutes ago) by user Pheisito in the Leaks/Databases section of DarkForums. The title suggests an announcement, possibly a leak or ransomware statement, but the body is not visible and no victim is named. It is worth a quick manual review because it is fresh and in Spanish, which can indicate a Latin American target, but there is no confirmed entity or scale yet.

IncRansom publica al bufete canadiense Bereskin Parr y Smart & Biggar

Bereskin Parr / Smart & Biggar

The IncRansom leak site has published Bereskin Parr / Smart & Biggar, a Canadian intellectual-property law firm, claiming theft of client case data and related files. IP firms concentrate patent, trademark and litigation material for corporate clients, so a confirmed leak can expose trade secrets and third-party confidential information well beyond the firm itself. Defenders should treat this as a live extortion case and monitor for downstream publication of client data.

Venta de acceso al entorno de staging del SSO oficial de Madagascar

Gobierno de Madagascar (SSO oficial)

A threat actor is selling access to a staging environment linked to Madagascar's official single sign-on service. Staging SSO tenants routinely mirror production identity configuration, test accounts and integration secrets, so a buyer gains a realistic path into government authentication infrastructure. Even though the target is outside Latin America, it is a concrete named government access sale rather than generic chatter and warrants tracking for credential reuse.

Filtración de datos de profesionales sanitarios franceses (95K)

professionnels-sante.fr

A 95,421-record database of professionnels-sante.fr, a French health-professionals directory, is being leaked. Health-sector data exposes practitioners' identities and contact details, aiding phishing and fraud. Healthcare leaks also raise regulatory and patient-safety concerns.

Datos del Ministerio de Educación francés (Académie de Lyon) a la venta

Académie de Lyon (French Ministry of Education)

A seller is offering data from the Académie de Lyon, part of France's Ministry of Education, likely containing staff or student records. Government education data enables identity theft and phishing against public employees. Even outside our region it signals an active campaign against EU public sector.