Breach Intelligence

6,142

Total breached databases

Sometime before 2025, customer login credentials for Farmacia del Ahorro (fahorro.com.mx), a large Mexican pharmacy chain, were allegedly compromised and later published on a hacking forum. Reports suggest the data was collected from infostealer logs and credential-stuffing lists targeting the site. Approximately 18,500 credential records were exposed, each pairing a login (email address or username) with a plaintext password. No other personal data was included.
  • Date: 2025
  • Domain: fahorro.com.mx
  • Threat Actor: ChronusTeam
  • Country: Mexico
  • Category: Healthcare
  • Data: Email Addresses Passwords Usernames
  • Records: 18,493
  • Lines: 18,530
  • Size: 1.55 MB
  • Passwords: Plaintext
Sometime before August 2025, the Qatar-based online store AlBazaar (albazaar.shop), a Magento e-commerce site selling Middle Eastern-themed products and home decor, allegedly suffered a data breach that was published on a hacking forum. Reports suggest the exposed data covered approximately 950 customers and included names, email addresses, phone numbers, physical addresses, order and payment information, and a small number of salted MD5 password hashes.
  • Data: Email Addresses Passwords Names Phone Numbers Geographic Locations Payment Information Order Information Birthdates Personal Information
  • Records: 11,769
  • Lines: 1,418,023
  • Size: 99.64 MB
  • Passwords: MD5 Salted
  • Cracked: 0%
In mid-2026, Smarty, a service of the Armenian company Arpinet (arpinet.am), allegedly suffered a data breach carried out by a threat actor known as "Bashe" (also referred to as Apt73 / Eraleign). Arpinet's Smarty is an Armenian online real-estate platform offering property analysis, search and monitoring tools along with cadastral and legal-data integration. Reports suggest the breach exposed 15,161 user records, each containing a first name, last name, and mobile phone number. No passwords or email addresses were included.
  • Date: Jun 3, 2026
  • Domain: arpinet.am
  • Threat Actor: Bashe
  • Country: Armenia
  • Category: Real Estate
  • Data: Names Phone Numbers Geographic Locations
  • Records: 15,161
  • Lines: 15,161
  • Size: 656.03 KB
  • Passwords: No
In February 2021, a depositor lead list from the forex/CFD broker LBLV (lblv.com) was allegedly leaked. Reports suggest it contained approximately 2,600 records of depositors (predominantly in Germany and the UK), including full names, email addresses, phone numbers, country of residence, registration timestamps and deposit amounts. No passwords were included in the exposed data.
  • Date: Feb 4, 2021
  • Domain: lblv.com
  • Category: Finance & Payments
  • Data: Email Addresses Names Phone Numbers Geographic Locations Payment Information Site Activity
  • Records: 2,661
  • Lines: 1,046
  • Size: 261.56 KB
  • Passwords: No
Sometime before April 2026, the government of Durango State, Mexico (durango.gob.mx) allegedly suffered a data breach exposing internal Active Directory and Outlook Web Access data. Reports suggest the exposed data covered roughly 44,000 records across employee, contractor, intern and government-worker accounts, and included email addresses, full names, usernames, job titles and departments, plaintext passwords recovered from memory (mimikatz), and NTLM/SHA1 credential hashes. Windows SAM and SYSTEM registry hives were also included in the dump.
  • Date: Apr 2026
  • Domain: durango.gob.mx
  • Threat Actor: deadlink
  • Country: Mexico
  • Category: Government
  • Data: Email Addresses Passwords Names Geographic Locations Usernames Job Information Places of Birth
  • Records: 48,011
  • Lines: 44,243
  • Size: 14.37 MB
  • Passwords: Plaintext, NTLM, SHA-1
Sometime before 2025, the contents of an email mailbox belonging to GTA Web Designer (gtawebdesigner.com) allegedly appeared on a hacking forum. GTA Web Designer is a web-design agency. Reports suggest the leak comprised a scrape of the company's inbox — thousands of email messages plus attached documents — from which approximately 11,000 unique correspondent email addresses were recovered. No passwords were included; the exposed data consists of email addresses and the message contents.
  • Data: Email Addresses
  • Records: 11,218
  • Lines: 121,789
  • Size: 34.95 MB
  • Passwords: No
In September 2025, a database belonging to Rocks and Gold (rocksandgold.co.il), an Israeli vintage and secondhand jewelry store, was allegedly published on a hacking forum. Reports suggest approximately 6,000 customers were exposed across roughly 9,000 records, including email addresses, usernames, phpass-hashed passwords, full names, geographic locations and account activity dates.
  • Date: Sep 2025
  • Domain: rocksandgold.co.il
  • Threat Actor: N1KA
  • Country: Israel
  • Category: E-commerce & Retail
  • Data: Email Addresses Passwords Names Physical Locations Geographic Locations Usernames Site Activity
  • Records: 9,176
  • Lines: 877,754
  • Size: 185.71 MB
  • Passwords: PHPass
  • Cracked: 0%

Frequently Asked Questions

A data breach is unauthorized access to data (often involving account takeover, malware, or misconfigured infrastructure). A data leak is exposure of data due to mistakes like public cloud storage, open databases, or accidental publishing. A database dump is a packaged dataset that may come from a breach, leak, scraping, or aggregation.

Change passwords for any affected accounts immediately, prioritizing email, banking, and any account that shares the same password. Enable multi-factor authentication wherever possible. Monitor your accounts for suspicious activity and consider placing a fraud alert or credit freeze if financial data was exposed.

Start with containment and verification: confirm what data was exposed, identify the entry point, rotate credentials (especially SSO, VPN, email), and enforce MFA. Then investigate affected systems, notify stakeholders as required, and harden controls to prevent recurrence. A structured incident response plan helps keep the work measurable and compliant.

Dark web monitoring helps you spot exposure signals early — before stolen data is widely reused for account takeover or targeted attacks. Monitoring complements vulnerability management by revealing when attackers already have leverage. Pair it with continuous attack surface monitoring and strong Asset Discovery to reduce blind spots.

Not always. Some datasets are old, incomplete, or derived from third parties. However, any exposure increases risk because credentials and personal data can be reused indefinitely. Treat it as a priority signal: rotate credentials, enforce MFA, review suspicious logins, and audit the systems that could have produced the data.

SynScan helps you connect the dots between attack surface exposure, vulnerabilities, and breach signals so you can prioritize remediation and reduce the chance of repeat incidents.