Underground · what matters today

El ransomware Helix publica a la cafetera Westrock Coffee

Westrock Coffee

Ransomware group Helix has listed Westrock Coffee, a US coffee supplier with roughly $1.2bn annual revenue, on its leak site. Links and passwords unlock in 24 hours, so the window to verify stolen data and assess supply-chain exposure is short. It sits outside Latin America but the victim's size makes it useful for sector and partner alerts.

Filtración de base de datos de Panamá Digital

Panamá Digital

A DarkForums user posted a 'PANAMA DIGITAL DB' dump on 21 Oct 2026, attributed to a Panamanian digital/telecom-type entity. Latin American subscriber or customer data enables phishing, SIM-swap and account takeover against local users and businesses. Verify the sample, identify the exact company and notify CERT-PA before the data spreads.

Filtración de base de datos de Edmunds por ShinyHunters

Edmunds

ShinyHunters listed an Edmunds database on the Spear forum in January 2026, exposing user account and contact information from the car-shopping platform. The post is months old, so it is not a fresh alert, but the data still fuels phishing and credential reuse. Teams should treat it as a known exposure rather than a new incident.

Base de datos de bordersstore.com con más de un millón a la venta

bordersstore.com

A seller is offering a bordersstore.com database of about one million records on DarkForums, posted early October 2026. Customer emails, passwords and personal details from an online store enable credential stuffing and phishing against its user base. Retail defenders should check for reuse and notify affected customers.

Base de datos con 829K registros de Coinbase y cripto a la venta

Coinbase / crypto

A forum seller posted an 829K-record 'crypto/Coinbase' private-data set marked new for 2026. These large collections usually contain stolen credentials and KYC details enabling exchange account takeover, draining and targeted phishing. Crypto platforms and their customers should enforce MFA and watch for anomalous logins.

Base de datos con 976K registros de FedEx y UPS a la venta

FedEx / UPS

A seller advertises a 976K-record dataset of FedEx and UPS private data in the USA, tagged as new for 2026. Such large logistics datasets typically bundle stolen credentials, addresses and tracking data useful for fraud, account takeover and parcel-interception schemes. SOC teams at logistics and e-commerce firms should review for exposed accounts and abuse.

Venta de base de datos de HSBC con 13 millones de registros

HSBC

A seller posted a 13-million-record HSBC database on DarkForums in early October 2026. If authentic, it exposes customer KYC and financial data of a global bank with operations across Argentina, Mexico and Latin America. Financial defenders should watch for credential stuffing, phishing and account takeover.

Base de datos de Edmunds publicada por ShinyHunters

Edmunds

ShinyHunters posted a database attributed to Edmunds, the US vehicle-shopping and dealer-inventory platform, in a thread dated January 2026. The dump is roughly nine months old, so it is not a fresh alert, but it is still useful for credential-stuffing and phishing checks against Edmunds-linked corporate accounts. Low regional relevance; action only if you hold dealer, supplier or partnership relationships with the company.

Filtración de la Secretaría de Educación de São Paulo

Secretaria de Educação do Estado de São Paulo

A leak thread on the Exilio404 forum claims a data breach of the São Paulo State Education Secretariat, a Brazilian government body managing schools and student/teacher records. Such data enables identity fraud and phishing targeting public-sector staff and students, and may signal compromise of government infrastructure. The date is unconfirmed, so treat as potentially stale but verify.

Ransomware Akira publica a la minorista Cascade Flooring America

Cascade Flooring America

Akira listed US flooring retailer Cascade Flooring America with a threatened 50GB leak of corporate data and employee personal information. It is a fresh named victim but small, US-based and outside the AR-LATAM focus, so it ranks low for immediate alerting.

Ransomware Akira publica al fabricante de PCB Flextron Circuit Assembly

Flextron Circuit Assembly

Akira listed Singapore-based PCB manufacturer Flextron Circuit Assembly and threatens to release 34GB of corporate data, including employee passports, driver's licenses, financials and NDAs. The exposure of identity documents and supplier contracts makes this relevant to electronics supply-chain defenders, though the victim is outside Latin America.

Venta de acceso RDP con privilegios de administrador

A seller on BlackBones is advertising RDP access with administrative privileges, a common initial-access vector for network intrusion and ransomware staging. No specific victim or geolocation is named, so the direct exposure is unknown, but buyers of such access typically use it for lateral movement and data theft. Defenders should treat admin RDP as a high-value foothold and enforce MFA, restrict RDP exposure and monitor for credential reuse.

Ransomware 'hyflock' publica al club nocturno vietnamita Dang Vuong Cac

dangvuongcac.com

The 'hyflock' group listed dangvuongcac.com, a high-end KTV/entertainment venue in Ho Chi Minh City, claiming to hold hotel-room and chat records. Relevance to Latin American critical infrastructure is low, but the data type (PII and chat logs) and the actor's ongoing activity are worth noting for broader tracking.

Hyflock publica al minorista gabonés Gabonmeca

Gabonmeca (gabonmeca.com)

The 'hyflock' ransomware group claims gabonmeca.com, a large office-supplies and IT-equipment retailer and distributor in Gabon, as a victim. The company runs e-commerce and B2B ordering, so a leak would expose corporate customer contacts, order data and possibly payment details across the region. It shows hyflock's continued targeting of African retail and distribution firms, a useful indicator for sector-wide hunting.

Ransomware 'pear' publica a la aseguradora Adobe Insurance Brokers

Adobe Insurance Brokers, LLC

The 'pear' group has listed Adobe Insurance Brokers LLC, an independent insurance agency in Morgan Hill, California, on its leak site. Insurance brokers hold sensitive client PII such as policy details, addresses and tax identifiers, so a full data leak exposes policyholders to identity theft and downstream fraud. Watch for reuse of agency-portal credentials and phishing of the agency's clients.

Registros internos del chat del grupo Black Basta disponibles para descarga

Black Basta (grupo de ransomware)

A forum post offers a download of the leaked internal chat logs of the Black Basta ransomware group. The material appears to be a re-post of an earlier public leak rather than a fresh breach, but it still offers valuable insight into the group's TTPs, affiliates and tooling for detection and attribution.

Base de datos de la academia de la RFEF (113.681 registros) ofrecida

Real Federación Española de Fútbol (academia.rfef.es)

A clandestine forum thread advertises a database from academia.rfef.es, the training platform of Spain's Royal Football Federation, with about 113,681 records. It likely exposes students and technical staff with personal data and account material, valuable for targeted phishing and identity fraud against the sports sector. Authenticity should be verified and the entity notified to the Spanish data protection authority.

1,8 millones de credenciales de Privalia Brasil publicadas

Privalia (Brasil)

An actor posted roughly 1.8 million URL:log:pass pairs attributed to Privalia, a fashion retailer with a large Brazilian customer base. The dump enables credential stuffing against customer accounts and staff panels, and its size suggests password reuse across other Latin American services. Defenders should force resets, watch for anomalous logins and check for employee credentials in the set.

Base de datos de 300K clientes de upcworld.ae a la venta

UPC World (upcworld.ae)

A database of roughly 300,000 records from upcworld.ae is offered for sale. Though moderate in size, it can expose customer and order data enabling phishing and fraud against the UAE-based retailer's clients. It is worth tracking as part of a seller's ongoing dump series.

Base de datos de Rotoris.com con más de 1M de registros a la venta

Rotoris.com

A database of more than 1 million records attributed to Rotoris.com is listed for sale on DarkForums. The volume suggests customer account and contact data rather than a trivial scrape. Buyers can pivot this into credential stuffing and targeted phishing against the site's user base.

Filtración de la base de datos del portal business.adobe.com de Adobe

Adobe

A database associated with Adobe's business portal is circulating in a leak forum with active replies within the last hour. If genuine, it exposes corporate account and contact data of enterprise customers. Adobe is a high-value SaaS vendor, so leaked business-portal credentials warrant checking for reuse across connected enterprise services.

Base de datos de 7M de registros de LOHONO Luxury a la venta

LOHONO Luxury

A seller is offering a 7-million-record database attributed to the luxury brand LOHONO. At this scale the dump would include customer PII and transaction data valuable for fraud and phishing. Large e-commerce leaks remain a primary source for downstream account-takeover attacks.

Base de datos de Giant Tiger redistribuida como filtración gratuita

Giant Tiger

The Giant Tiger retail database is being redistributed as a free download on BreachForums, indicating the Canadian retailer's customer data is actively circulating. Retail leaks typically expose names, emails, phone numbers and order history usable for phishing and account takeover. Even reposted data fuels credential-stuffing and social-engineering campaigns against customers.

Base de datos de 3M de registros de AD LPG (Dubái) a la venta

AD LPG (Dubái, EAU)

A database of roughly 3 million records is being sold for AD LPG, an approved distributor of liquefied petroleum gas in Dubai, UAE. LPG distribution is critical energy infrastructure, and the data reportedly covers customers, orders and operational details. Exposure enables targeted fraud and potential operational reconnaissance against a fuel-supply operator.