Breach Intelligence

6,875

Total breached databases

Farmacia del Ahorro 2025

Farmacia del Ahorro 2025

Sometime before 2025, customer login credentials for Farmacia del Ahorro (fahorro.com.mx), a large Mexican pharmacy chain, were allegedly compromised and later published on a hacking forum. Reports suggest the data was collected from infostealer logs and credential-stuffing lists targeting the site. Approximately 18,500 credential records were exposed, each pairing a login (email address or username) with a plaintext password. No other personal data was included.
  • Date: 2025
  • Domain: fahorro.com.mx
  • Threat Actor: ChronusTeam
  • Country: Mexico
  • Category: Healthcare
  • Data: Email Addresses Passwords Usernames
  • Records: 18,493
  • Lines: 18,530
  • Size: 1.55 MB
  • Passwords: Plaintext

Durango Government (Mexico) 2026

Sensitive
Sometime before April 2026, the government of Durango State, Mexico (durango.gob.mx) allegedly suffered a data breach exposing internal Active Directory and Outlook Web Access data. Reports suggest the exposed data covered roughly 44,000 records across employee, contractor, intern and government-worker accounts, and included email addresses, full names, usernames, job titles and departments, plaintext passwords recovered from memory (mimikatz), and NTLM/SHA1 credential hashes. Windows SAM and SYSTEM registry hives were also included in the dump.
  • Date: Apr 2026
  • Domain: durango.gob.mx
  • Threat Actor: deadlink
  • Country: Mexico
  • Category: Government
  • Data: Email Addresses Passwords Names Geographic Locations Usernames Job Information Places of Birth
  • Records: 48,011
  • Lines: 44,243
  • Size: 14.37 MB
  • Passwords: Plaintext, NTLM, SHA-1
Acomee.com.mx 2025

Acomee.com.mx 2025

Sometime before mid-2026, the Mexican online store Acomee (acomee.com.mx) allegedly suffered a data breach attributed to a threat actor known as "Blackout" (Exiliados). Acomee is a Mexican e-commerce retailer. Reports suggest the breach exposed approximately 16,000 customer records, including full names, email addresses, usernames, plaintext passwords, phone numbers, RFC tax identifiers, and physical shipping and billing addresses across Mexico.
  • Date: 2025
  • Domain: acomee.com.mx
  • Threat Actor: Blackout
  • Country: Mexico
  • Category: E-commerce & Retail
  • Data: Email Addresses Passwords Names Phone Numbers Physical Locations Geographic Locations Usernames Government IDs Site Activity Tax IDs
  • Records: 16,472
  • Lines: 16,748
  • Size: 7.7 MB
  • Passwords: Plaintext
Coahuila 2025

Coahuila 2025

Sometime before 2025, a government portal of the Mexican state of Coahuila (coahuila.gob.mx) allegedly suffered a data breach. According to the threat actor, the data was obtained by scraping the portal through unpatched web vulnerabilities. It has been reported that a dataset of approximately 1,400 records of registered taxpayers and small-business owners was exposed. The compromised data allegedly included full names, RFC tax identification numbers, home and workplace addresses (street, neighborhood, and postal code), phone numbers, and business information. No passwords were included in the exposed data.
  • Date: 2025
  • Domain: coahuila.gob.mx
  • Threat Actor: M1sery157
  • Country: Mexico
  • Category: Government
  • Data: Names Phone Numbers Physical Locations Geographic Locations Government IDs Tax IDs Job Information Company Information
  • Records: 1,397
  • Lines: 1,398
  • Size: 337.9 KB
  • Passwords: No
Salud Mexico 2025

Salud Mexico 2025

Sensitive
Sometime before 2025, Mexico's Secretaría de Salud (salud.gob.mx) allegedly suffered a data breach affecting its Programa de Prevención y Control de Cáncer Cervicouterino (cervical cancer prevention and control program). The threat actor known as Olympus Group claimed responsibility, alleging that the personal and health information of over 1,500 patients — described as women and vulnerable individuals — was exposed. The recovered dataset contains patient records including full names, CURP national identification numbers, dates of birth, home addresses, and phone numbers. No passwords were included in the exposed data.
  • Date: 2025
  • Domain: salud.gob.mx
  • Threat Actor: Olympus_Group
  • Country: Mexico
  • Category: Healthcare
  • Data: Names Phone Numbers Geographic Locations Government IDs Health Information Birthdates Personal Information
  • Records: 26
  • Lines: 104,087
  • Size: 2.69 MB
  • Passwords: No

Fiscalia Edomex 2025

Sometime before 2025, the Fiscalía General de Justicia del Estado de México (FGJEM), the Attorney General's office of the State of Mexico, allegedly suffered a data breach. Reports suggest a threat actor published the complete personnel directory of the agency, containing approximately 1,800 employees across its divisions. The exposed data reportedly included full names, job positions, work areas and departments, telephone extensions, and the region and facility each employee is assigned to. No passwords were included.
  • Data: Names Phone Numbers Geographic Locations Job Information
  • Records: 1,797
  • Lines: 1,797
  • Size: 209.24 KB
  • Passwords: No
Laboratorio Ceflo 2025

Laboratorio Ceflo 2025

Sensitive
Sometime before 2025, Laboratorio Ceflo (laboratorioceflo.com), a Mexican clinical laboratory, allegedly suffered a data breach. Reports suggest the incident stemmed from an attacker who published the data publicly after the lab did not respond to a prior contact. Approximately 19,000 individuals were affected. The exposed records allegedly included full names, birthdates, phone numbers, some email addresses, and sensitive health information such as diagnostic test types and results, along with dates of death. No passwords were included.
  • Data: Email Addresses Names Phone Numbers Geographic Locations Health Information Site Activity Birthdates Date of Death
  • Records: 21,696
  • Lines: 21,697
  • Size: 2.91 MB
  • Passwords: No

Frequently Asked Questions

A data breach is unauthorized access to data (often involving account takeover, malware, or misconfigured infrastructure). A data leak is exposure of data due to mistakes like public cloud storage, open databases, or accidental publishing. A database dump is a packaged dataset that may come from a breach, leak, scraping, or aggregation.

Change passwords for any affected accounts immediately, prioritizing email, banking, and any account that shares the same password. Enable multi-factor authentication wherever possible. Monitor your accounts for suspicious activity and consider placing a fraud alert or credit freeze if financial data was exposed.

Start with containment and verification: confirm what data was exposed, identify the entry point, rotate credentials (especially SSO, VPN, email), and enforce MFA. Then investigate affected systems, notify stakeholders as required, and harden controls to prevent recurrence. A structured incident response plan helps keep the work measurable and compliant.

Dark web monitoring helps you spot exposure signals early — before stolen data is widely reused for account takeover or targeted attacks. Monitoring complements vulnerability management by revealing when attackers already have leverage. Pair it with continuous attack surface monitoring and strong Asset Discovery to reduce blind spots.

Not always. Some datasets are old, incomplete, or derived from third parties. However, any exposure increases risk because credentials and personal data can be reused indefinitely. Treat it as a priority signal: rotate credentials, enforce MFA, review suspicious logins, and audit the systems that could have produced the data.

SynScan helps you connect the dots between attack surface exposure, vulnerabilities, and breach signals so you can prioritize remediation and reduce the chance of repeat incidents.