Underground · what matters today

Comunicado sin identificar en la sección de bases de datos filtradas de DarkForums

A brand-new Spanish-language 'COMUNICADO' was posted (about 3 minutes ago) by user Pheisito in the Leaks/Databases section of DarkForums. The title suggests an announcement, possibly a leak or ransomware statement, but the body is not visible and no victim is named. It is worth a quick manual review because it is fresh and in Spanish, which can indicate a Latin American target, but there is no confirmed entity or scale yet.

IncRansom publica al bufete canadiense Bereskin Parr y Smart & Biggar

Bereskin Parr / Smart & Biggar

The IncRansom leak site has published Bereskin Parr / Smart & Biggar, a Canadian intellectual-property law firm, claiming theft of client case data and related files. IP firms concentrate patent, trademark and litigation material for corporate clients, so a confirmed leak can expose trade secrets and third-party confidential information well beyond the firm itself. Defenders should treat this as a live extortion case and monitor for downstream publication of client data.

Venta de acceso al entorno de staging del SSO oficial de Madagascar

Gobierno de Madagascar (SSO oficial)

A threat actor is selling access to a staging environment linked to Madagascar's official single sign-on service. Staging SSO tenants routinely mirror production identity configuration, test accounts and integration secrets, so a buyer gains a realistic path into government authentication infrastructure. Even though the target is outside Latin America, it is a concrete named government access sale rather than generic chatter and warrants tracking for credential reuse.

Filtración de datos de profesionales sanitarios franceses (95K)

professionnels-sante.fr

A 95,421-record database of professionnels-sante.fr, a French health-professionals directory, is being leaked. Health-sector data exposes practitioners' identities and contact details, aiding phishing and fraud. Healthcare leaks also raise regulatory and patient-safety concerns.

Datos del Ministerio de Educación francés (Académie de Lyon) a la venta

Académie de Lyon (French Ministry of Education)

A seller is offering data from the Académie de Lyon, part of France's Ministry of Education, likely containing staff or student records. Government education data enables identity theft and phishing against public employees. Even outside our region it signals an active campaign against EU public sector.

Publicación de supuestos datos militares de Israel

Israel military

A forum user posted files labeled as Israeli military data just minutes ago. The claims are unverified, but any genuine military leak carries national-security implications and could fuel targeting. Worth flagging for verification and to track if corroborated by other sources.

Base de datos de ciudadanos de Australia 2026 a la venta

Australia (citizen database)

A seller on DarkNetArmy is advertising an 'Australia Citizen Database 2026', implying a large set of national identity records. Citizen registries are high-value for identity fraud and mass targeting. The claim is unverified, but the scale and subject warrant monitoring.

Filtración de base de datos de bomberos franceses (124K pompiers.fr)

pompiers.fr (French fire service)

A fresh 124K-record dump of pompiers.fr, France's fire and emergency services portal, was posted today. Emergency-service data can expose responder identities and internal contacts, useful for phishing or physical targeting. Critical-infrastructure-adjacent leaks deserve priority triage even outside our region.

Presunta filtración de datos del Ministerio de Defensa de India

Indian Ministry of Defence

A LeakForum user claims to have leaked data belonging to India's Ministry of Defence, a national military body. If authentic, exposure of internal documents or personnel records poses serious national-security and operational risk. Defence-sector leaks also aid targeting and social engineering against government staff.

Venta de acceso al entorno SSO de un organismo oficial de Madagascar

Government of Madagascar (SSO)

A seller is offering access to the staging SSO environment of Madagascar's official government portal, which can expose authentication infrastructure and test credentials. Staging environments often mirror production identity systems, enabling lateral movement into citizen-facing services. Sale of government identity access is high-value for follow-on intrusions.

Base de datos de 50 millones de registros de Indonesia a la venta

Indonesia (JakartaGhostDigital)

A 50-million-record Indonesian dataset attributed to JakartaGhostDigital is being traded on xReactor in an old, heavily bumped thread. Population-scale datasets like this fuel credential stuffing, OTP/SMS fraud and targeted social engineering. It is a large leak but neither fresh nor relevant to Argentina/LATAM, so it is low priority for regional defenders.

Filtración de 3,5 GB de pasaportes y documentos de identidad de EAU

Emiratos Árabes Unidos (pasaportes/IDs)

A 3.5 GB archive said to contain UAE passports and national identity documents keeps circulating on a cybercrime forum, now dozens of pages deep in replies. Government identity documents sustain identity fraud, KYC bypass and account takeover long after the original leak. It is a genuine government document exposure, but old and outside Latin America, so it is background context only.

Ransomware n0n publica a la proveedora sanitaria estadounidense Heritage Senior Living

Heritage Senior Living

Group n0n has published Heritage Senior Living, a US healthcare support services provider, claiming to hold network security configurations, internal segmentation maps and remote access account structures, marked as unpaid and exposed. That mix of remote-access and segmentation detail is exactly what enables follow-on intrusion or lateral movement against healthcare networks. It is a live victim listing, but outside the Latin America region, so it ranks below regional incidents.

Ransomware lamashtu publica a la química WEPOS Chemie

WEPOS Chemie

The lamashtu group listed WEPOS Chemie, a German maker of specialized cleaning and care products. Ransomware against a chemicals manufacturer risks operational and data disruption. Part of a cluster of lamashtu listings targeting German and French industrial firms.

Ransomware lamashtu publica al fabricante MECA-PRECIS

MECA-PRECIS

The lamashtu group listed MECA-PRECIS, a French precision-stamping and metal-components manufacturer serving automotive and appliance industries. Ransomware disruption to a manufacturing supplier can cascade to OEM production lines. Signals ongoing lamashtu activity against European manufacturers.

Ransomware lamashtu publica al integrador FuG-Gruppe

FuG-Gruppe

The lamashtu ransomware group listed FuG-Gruppe, a German IT systems integrator (Systemhaus) and ERP provider for industrial and steel-trading firms. As a managed IT/ERP supplier, a compromise here creates supply-chain risk for many downstream industrial clients. Relevant for defenders tracking integrator exposure.

Acceso al SSO oficial de Madagascar en venta (staging)

Madagascar official SSO

A seller offers access to the staging environment of Madagascar's official national single-sign-on (SSO) system. Government authentication infrastructure is high value, and staging access can expose configurations, test credentials and paths into production. A genuine access-sale lead against a national government identity system.

Filtración de base de datos de Ncino con 790.000 clientes

Ncino

A seller offers a database leak of Ncino, a US banking-software provider, claiming 790,000 customer records. Ncino serves financial institutions, so the data could fuel targeted fraud and phishing against banks and their clients. A large financial-sector leak worth monitoring for downstream abuse.

Re-subida de bases de datos del ECU911 y Ministerio de Educación de Ecuador

ECU911 / Ministerio de Educación de Ecuador

A forum post re-uploads databases attributed to Ecuador's ECU911 emergency service and the Ministry of Education, including citizen records. ECU911 is critical emergency-response infrastructure, so exposure of personal and contact data enables fraud and targeted phishing. Although a re-upload of previously leaked data, it confirms the data is still actively circulating.

Filtración de 162 pasaportes de ciudadanos sudamericanos

América del Sur (documentos de identidad)

A forum post shares 162 South American passports, likely scanned identity documents. The scale is small but such documents enable identity theft, account takeover and fraudulent KYC bypass. Relevant for monitoring cross-border identity fraud affecting the region.

Publicados 552.000 registros médicos en BreachForums

Sector salud (origen no confirmado)

A forum user posted a 552,000-record medical database on BreachForums on 21 October 2026. Healthcare records usually include patient names, IDs, diagnoses and contact data, prime material for fraud and extortion. The volume and freshness warrant rapid triage to determine whether it overlaps the Argentinian medical leak or another provider.

Filtración de 552.000 registros médicos argentinos

Argentina (sector salud)

A user 'scraped' published a database of roughly 552,000 medical records from Argentina on DarkForums, posted only minutes ago. Healthcare data typically contains patient identities, IDs, diagnoses and contact details, making it highly sensitive under data-protection law and valuable for fraud and extortion. The freshness and country-specific focus demand immediate verification and incident response for the affected health provider.

Lista de 64.000 accesos de correo corporativo a la venta

A freshly posted list of roughly 64,000 corporate business email credentials is circulating. These valid mail-access combos enable credential stuffing and business email compromise across many companies. Not tied to a specific public-sector victim, but useful for defenders to hunt for reused corporate passwords.

Base de datos de jobgurusnigeria.com (480K registros) a la venta

jobgurusnigeria.com

A seller is offering the database of jobgurusnigeria.com, a Nigerian job portal, containing roughly 480,000 records. Job boards hold applicant PII such as names, contact details and CVs, valuable for phishing and identity fraud. Buyers could weaponize it, so the host org and its users face account-takeover and fraud risk.