Underground · what matters today

Filtración de 25 GB de la Academia Nacional de Ciencia y Tecnología de Filipinas

National Academy of Science and Technology (Philippines)

A 25 GB database belonging to the Philippines' National Academy of Science and Technology, a government-affiliated body, has been leaked. The volume suggests large document or personal-data exposure affecting a public institution. Relevant for monitoring government data leaks and potential downstream phishing.

Filtración de 10 GB de datos de Nestlé

Nestlé

A 10 GB trove of data attributed to Nestlé, the global food and beverage giant, has been posted for leak. The dataset could include internal documents, employee or partner information. Even outside the region, supply-chain and subsidiary exposure makes this relevant for defenders tracking leaked corporate data.

Ransomware BrainCipher ataca a la clínica argentina Clínica Romero

clinicaromero.com

BrainCipher ransomware listed clinicaromero.com, a healthcare provider in Argentina, on its leak site. Healthcare is critical infrastructure, so exposed patient records, PII and disrupted services carry real risk. Argentine and regional defenders should treat this as a live incident and check for exposure.

Base de datos de un millón de usuarios de Deezer Rusia a la venta

Deezer Russia

A DarkForums seller posted a one-million-record Deezer Russia database on 19-10-2026. Music-streaming accounts carry email, subscription and payment metadata useful for credential stuffing and phishing. Streaming-service credentials are also frequently reused against corporate SSO, so it is worth flagging.

Ransomware Interlock publica al Coastal Alabama Community College

Coastal Alabama Community College

Interlock published the US community college after claiming it ignored the intrusion, alleging student education records, protected health information, financial aid data, employee files, SSNs and card data were taken. Education-sector victims usually face long notification cycles and heavy PII exposure. Useful for monitoring stolen student and financial-aid datasets resurfacing for sale.

Ransomware Aurora publica al fabricante británico Allmand-Smith (Stormguard)

Allmand-Smith Limited (Stormguard)

Aurora listed the UK building-products manufacturer with claimed domain admin credentials and a full domain controller dump, plus a live NatWest Bankline database with account and payee data. That combination of AD compromise and banking access is a template for fraudulent payment redirection. Financial institutions and UK suppliers should treat it as active threat intel.

Base de datos del Ministerio de Comercio de Kuwait publicada

Kuwaiti Ministry of Commerce & Industry

A freshly posted thread (minutes old) offers a database attributed to the Kuwaiti Ministry of Commerce & Industry dated 2026/10/19. Government commercial registries typically contain companies, licence holders and contact data useful for fraud and targeting. Outside LatAm, but a current sovereign leak worth tracking for regional spillover and supplier risk.

A la venta base de datos de 44 millones de registros de seguros de autos de EE.UU.

US car insurance sector

A seller claims to hold 44 million lines of US car insurance customer data posted on 19-10-2026, including policyholder identity and vehicle details. Scale is large enough to fuel identity theft, KYC fraud and targeted phishing against policyholders. Insurers and their fraud teams should monitor for reposts and credential reuse.

Presunta filtración de datos de la argentina Globant

Globant

A DarkForums user posted a 'Globant.com Leak' on 19-10-2026 with no verified sample list shown. Globant is a major Argentina-headquartered software and IT services provider whose clients include banks, airlines and government agencies across LatAm, so any real breach would cascade to those customers. Defenders at Globant-dependent organizations should watch for credential stuffing and source-code or client-data exposure.

Filtración de la base de datos de la India Rentomojo

Rentomojo

A post dated 2026-10-19 shares a database reportedly from Rentomojo, an Indian furniture and appliance rental company. Customer PII from such a service can enable fraud and account takeover against subscribers. The scale is unconfirmed and the target is mid-tier, so impact is limited but worth tracking.

Base de datos de la CAF francesa (22,4M) recirculada

CAF (Caisse d'Allocations Familiales), France

A 22.4-million-record dataset attributed to France's CAF family benefits agency is being shared, but it is dated 2025 and appears to be a re-posted older breach. The scale is significant—beneficiary and financial-aid data—yet its age makes it a stale, not a fresh, alert. Useful mainly for cross-referencing reused credentials and past-exposure monitoring.

Filtración de base de datos de MSI (Micro-Star)

MSI (Micro-Star International)

A post dated 2026-10-19 advertises an 'MSI leaked database,' presumably Micro-Star International. MSI is a major global hardware vendor, so any genuine customer or employee data leak carries supply-chain and fraud risk. Authenticity is unconfirmed and it may be a rehash of the earlier 2023 MSI incident, so treat with caution pending sample verification.

Ransomware SilentRansom publica al bufete Porter Hedges LLP

Porter Hedges LLP

SilentRansom group listed US law firm Porter Hedges LLP as a ransomware victim via ransomware.live. Law firms hold sensitive client and deal data, including energy-sector matters, making them attractive extortion targets. The listing signals an active leak-site publication; monitor for the eventual data release.

Filtración de datos personales del Congreso de Filipinas

Congress of the Philippines

A leak of personally identifiable information tied to the Congress of the Philippines was posted on 2026-10-19. Lawmakers' and staff PII can fuel targeted phishing, doxxing and influence operations against a national legislature. Worth flagging for government-sector awareness and IOC tracking.

Filtración de base de datos del Ministerio de Comercio de Kuwait

Kuwait Ministry of Commerce and Industry

A threat actor posted what it claims is a database from Kuwait's Ministry of Commerce and Industry, dated 2026-10-19, suggesting a fresh extraction. If genuine, it exposes citizen and business records handled by a national trade regulator, enabling phishing, fraud and identity abuse. Verify sample authenticity and watch for downstream use of the data.

Filtración de la base de datos nacional de ciudadanía de Pakistán

Government of Pakistan (national citizenship database)

A post dated 2026-10-19 offers a download of what is described as Pakistan's national citizenship database, a highly sensitive government dataset. If authentic, exposure of national ID and identity records at country scale is a serious state-level breach enabling mass identity fraud and targeting. High value for monitoring cross-border data reuse and downstream fraud.

Oferta de acceso root a servidores sin víctima identificada

A DarkForums marketplace seller posted 'root access' to servers with an 11M figure about eight hours ago, but the listing names no victim, sector or geography. Unattributed root-access offers are usually reposts or resold access rather than fresh intrusions, so value is limited until a target appears. Monitor the thread for samples or a named organisation.

Filtración de la base de datos de la tienda g-ladalle.com

g-ladalle.com

A DarkForums poster released a downloadable database for g-ladalle.com on 21 Oct 2026, the second French e-commerce leak surfacing in the same batch. Customer emails, addresses and hashed passwords from such shops are routinely reused for phishing, account takeover and card fraud. Confirm the sample's authenticity and scope before assessing exposure.

Filtración de base de datos del sitio francés bdv.fr

bdv.fr

On 19 Oct 2026 a DarkForums member announced a leaked database for bdv.fr, a French web domain, without disclosing record counts or the sample format in the listing. Even a mid-size dump hands attackers valid emails and password hashes for credential stuffing and targeted phishing. French defenders should confirm whether the data matches their user base and force resets.

El ransomware Helix publica a la cafetera Westrock Coffee

Westrock Coffee

Ransomware group Helix has listed Westrock Coffee, a US coffee supplier with roughly $1.2bn annual revenue, on its leak site. Links and passwords unlock in 24 hours, so the window to verify stolen data and assess supply-chain exposure is short. It sits outside Latin America but the victim's size makes it useful for sector and partner alerts.

Filtración de base de datos de Panamá Digital

Panamá Digital

A DarkForums user posted a 'PANAMA DIGITAL DB' dump on 21 Oct 2026, attributed to a Panamanian digital/telecom-type entity. Latin American subscriber or customer data enables phishing, SIM-swap and account takeover against local users and businesses. Verify the sample, identify the exact company and notify CERT-PA before the data spreads.

Filtración de base de datos de Edmunds por ShinyHunters

Edmunds

ShinyHunters listed an Edmunds database on the Spear forum in January 2026, exposing user account and contact information from the car-shopping platform. The post is months old, so it is not a fresh alert, but the data still fuels phishing and credential reuse. Teams should treat it as a known exposure rather than a new incident.

Base de datos de bordersstore.com con más de un millón a la venta

bordersstore.com

A seller is offering a bordersstore.com database of about one million records on DarkForums, posted early October 2026. Customer emails, passwords and personal details from an online store enable credential stuffing and phishing against its user base. Retail defenders should check for reuse and notify affected customers.

Base de datos con 829K registros de Coinbase y cripto a la venta

Coinbase / crypto

A forum seller posted an 829K-record 'crypto/Coinbase' private-data set marked new for 2026. These large collections usually contain stolen credentials and KYC details enabling exchange account takeover, draining and targeted phishing. Crypto platforms and their customers should enforce MFA and watch for anomalous logins.