Underground · what matters today

Base de datos de la brasileña FoodPlus ofrecida en foro clandestino

FoodPlus (foodplus.com.br)

A leak-forum thread advertises a database dump for foodplus.com.br, a Brazilian food-sector company. Details are behind a login wall, so the record count, date and fields are unknown, but customer or order data from a .com.br retailer is usable for phishing and card fraud. Worth monitoring as a possible LatAm commercial breach rather than a confirmed incident.

Filtración de la base de datos de Genesys Cloud Services

Genesys Cloud Services (genesys.com)

Genesys, a major cloud contact-center provider used by banks, telcos and governments worldwide, has a database listed for download on BreachForums. Such data can include customer records and account details handled on behalf of client organizations. A leak here has downstream impact on every enterprise that routes customer interactions through Genesys.

Documentos de identidad colombianos con selfies y número fiscal a la venta

Ciudadanos colombianos (documentos de identidad)

The listing advertises Colombian national ID cards (front and back), video selfies and tax numbers, a full KYC package for identity fraud. This combination defeats most remote onboarding checks used by banks, fintechs and telcos in Colombia. It enables synthetic-identity account opening, credit fraud and impersonation at scale across the region.

Base de datos de 15M de registros de E.ON Alemania a la venta

E.ON (Alemania)

A seller is offering a 15-million-record database attributed to E.ON, Germany's largest energy utility and a core piece of European critical infrastructure. Energy providers hold billing, customer and metering data that enables targeted phishing and fraud against grid customers. A fresh listing of this size against a utility should trigger immediate monitoring of credential reuse and lateral-movement risk.

Venta de paquete de leads de Argentina con DNI y correo

Datos de ciudadanos argentinos (DNI + email)

A seller is offering a leads package combining Argentine DNI numbers with email addresses on DarkForums. This kind of national-ID-linked contact data fuels targeted phishing, account takeover and identity fraud against Argentine residents. While scope is unconfirmed, DNI-plus-email pairing is highly useful for credential and smishing campaigns, so it merits monitoring.

Filtración gratuita de datos de Plus Ultra Líneas Aéreas

Plus Ultra Líneas Aéreas

A free release labeled Plus Ultra Airlines, an operator flying between Venezuela, Spain and Latin America, is being distributed on DarkForums. Airline datasets typically contain customer PII, passports and booking details useful for phishing and identity fraud. The airline operates cross-region routes, raising exposure for passengers across Latin America and Spain.

Base de datos del Ejército de Venezuela publicada en foro clandestino

Ejército de Venezuela (Venezuela Army)

A forum user claims to have exfiltrated and published a database belonging to the Venezuelan Army, posted two days ago. If authentic it exposes military personnel records (names, IDs, units, contacts), enabling targeted phishing, impersonation and insider recruitment against a national armed force. Defenders in the region should treat it as a confirmed military data exposure until proven otherwise.

Filtración de 1,9 GB de la Corte Superior de Justicia de Lima Norte

Corte Superior de Justicia de Lima Norte (Perú)

A 1.9 GB dump attributed to the Superior Court of Justice of Lima Norte, a Peruvian judicial body, is being posted on DarkForums. Judicial records can expose case files and litigant PII, enabling fraud, witness exposure and pressure on court operations. Any compromise of a national judiciary is high-value for defenders and warrants urgent validation.

Acceso a GitLab de gobiernos de varios países (filtración de 2024)

A 2024 thread claims leaked GitLab access for multiple national governments, without naming the affected tenants. GitLab access typically yields source code, CI/CD secrets and internal tickets for public-sector projects, which is why it was heavily discussed at the time. It is roughly two years old and unspecific, so it is useful only for victim identification, not as a live alert.

Repositorio Git privado de la estatal agrícola BADC de Bangladés expuesto

BADC – Bangladesh Agricultural Development Corporation

A private Git repository belonging to badc.gov.bd, Bangladesh's Agricultural Development Corporation, has been posted to a leak forum with its full source tree. Government repository leaks expose hard-coded credentials, API keys and undocumented endpoints across a .gov estate, easing follow-on intrusion. It sits outside Latin America but is a concrete public-sector compromise worth cross-referencing against regional .gob/.mil code exposure.

Base de datos de la alemana DFK Group filtrada

DFK Group (Germany)

A brand-new thread advertises a database attributed to the German firm DFK Group; the listing does not yet confirm scale or schema. If genuine, it exposes customer and internal contact data useful for phishing and business email compromise in the DACH region. Confidence stays low until a sample is validated.

Base de datos de 2 millones de clientes de Motel One a la venta

Motel One (Germany)

A seller posted within the last day offering a two-million-record database attributed to German hotel chain Motel One. Hotel data typically includes names, emails, booking history and partial payment details, which fuel phishing, booking fraud and credential reuse against corporate travel accounts. The freshness makes it worth alerting European customers and partners.

Venta de acceso a la base de datos de NIO Power en China

NIO Power (China)

A seller is offering access to NIO Power China's database containing user information such as phone numbers and addresses. NIO Power runs EV battery-swap and charging infrastructure, so customer and location records are tied to mobility operations rather than a generic webshop. The data supports phishing, physical tracking and further intrusion attempts against the operator's suppliers.

Venta de acceso, código fuente y datos de SK Telecom

SK Telecom

A seller claims to hold corporate access to SK Telecom together with stolen source code and internal data, presenting it as a large-corporation intrusion. SK Telecom is South Korea's largest telecom operator, so repository and access exposure can be chained into network and customer-system compromise. The post is undated, but live access plus code for a tier-1 telco is a high-value sale worth tracking.

Filtración de 20,5 millones de registros del SENA de Colombia

SENA (Servicio Nacional de Aprendizaje), Colombia

A seller is offering 20.5 million 'fresh' records from Colombia's national training service SENA in JSONL format, indicating a recent extraction rather than an old dump. SENA holds student, instructor and staff data for millions of Colombians, enabling targeted phishing, identity fraud and credential stuffing. Defenders should treat this as a live government breach and pivot on the delivery vector now.

Base de datos de votantes de Comelec (Filipinas) de 2016 reposteada

Philippines Comelec

The 2016 Philippines Commission on Elections (Comelec) voter database has resurfaced on a forum, but the thread is dated June 2023 and the underlying leak is years old. It contains large volumes of voter PII yet offers limited fresh operational value. Useful mainly as a historical identity-fraud and verification reference rather than a current alert.

Venta de datos filtrados del DHS de Estados Unidos

US Department of Homeland Security

A forum listing claims to sell leaked data tied to the US Department of Homeland Security (dhs.gov). If genuine, exposed DHS-related credentials or records would carry serious national-security impact. The listing sits behind a login wall and is unverified, so treat as unconfirmed but monitor for corroboration.

Filtración de datos del Instituto Espacial de Pakistán

Institute of Space Technologies Pakistan

A database belonging to Pakistan's Institute of Space Technologies has been leaked on a hacking forum on 19 October 2026. Space-technology institutes typically hold sensitive research, project, and personnel records. The fresh post raises risk of credential and IP exposure tied to defense-adjacent research programs.

Filtración de base de datos del dominio brasileño cmp.pt.org.br

cmp.pt.org.br

A database for the Brazilian .org.br domain cmp.pt.org.br has been posted for download on BreachForums in October 2026. The domain is tied to a political-party structure, so member or supporter PII may be exposed. Defenders in Brazil should watch for credential reuse and downstream phishing against affiliated accounts.

Venta de acceso y código fuente de SK Telecom

SK Telecom

A seller is advertising access to SK Telecom, one of South Korea's largest carriers, together with source code and internal data. Access plus source code is a high-value combination that enables network intrusion, subscriber-data theft, and IP exfiltration. Buyers could pivot into telecom critical infrastructure, so this warrants tracking and hunting for leaked credentials.

Base de datos de casino con 19 millones de registros a la venta

Online casino (unnamed)

A seller offers access to a casino dataset of over 19 million leads spanning multiple countries, advertised as fresh 2026 data. Gambling databases concentrate identity, payment and KYC data that enable fraud and account takeover. Financial institutions and payment processors serving iGaming customers in Latin America should watch for downstream abuse of these records.

Venta de webshell y acceso a base de datos de Malasia (0-day)

Malaysian organization (unnamed)

A seller advertises an unauthenticated webshell with database access against a Malaysian target, framing it as a critical 0-day. Sale of ready-made webshell access is a direct precursor to data theft and ransomware deployment. Besides the direct victim, it signals an exploitable web-facing flaw that regional organizations running similar stacks should patch and hunt for.

Filtración de archivo de correos diplomáticos de Israel

Israeli diplomatic service

An actor published a claimed archive of Israeli diplomatic emails on a major leak forum on 21 October 2026. Diplomatic correspondence is highly sensitive and fuels spearphishing, impersonation and intelligence collection against government contacts worldwide, including Latin American counterparts. Regional foreign ministries and embassies should treat inbound Israeli-government-themed email with heightened scrutiny.

Accesos RDP con privilegios de administrador a la venta en un foro clandestino

A verified seller on the BlackBones carding forum advertises remote desktop access with administrator rights, the kind of foothold typically harvested from commodity infostealer logs and exposed RDP services. The post names no victim, country or IP range, so it cannot currently be tied to an Argentine or Latin American organisation, but admin RDP access is a standard entry point for ransomware affiliates and access brokers. Worth monitoring this seller for follow-up posts that list specific companies or geolocations.