🇲🇽 🚨 MEXICO: 104.2 MILLION CITIZEN RECORDS ALLEGEDLY STOLEN FROM AN UNNAMED "MAJOR MEXICAN SYSTEM" A threat actor on an underground forum claims to have breached "a major Mexican system" and obtained a database of 104.2 million records of Mexican citizens. The actor does not name the system or organization. The actor claims the dataset includes: * 104.2 million records of Mexican citizens * Full names and dates of birth * Home addresses * Unique national identifiers (CURP-type IDs) The actor also says the vulnerability used had already been exploited by other threat actors and "STILL remains exposed". The claim has not been independently verified. ⚠️ Analyst Note: A set tying names, dates of birth and addresses to national ID numbers is ideal for identity fraud, SIM-swap and loan fraud, and convincing fake government, tax or bank messages. No source system, sample or field list is visible in the captured post, and a figure this large may be compiled or recycled from earlier Mexican leaks. Unverified threat-actor claim, NOT confirmation of a breach. Source: this is for subscribers only. Subscribe: xitter.cf/DailyDarkWeb/creator-s… #DDW #DarkWeb #Mexico #DataLeak #PII #IdentityFraud #ThreatIntelligence

🇲🇽 🚨 SAFEPAY RANSOMWARE CLAIMS MEXICO'S AUTONOMOUS UNIVERSITY OF AGUASCALIENTES The SafePay ransomware group has listed the Universidad Autónoma de Aguascalientes (UAA), a public university in Aguascalientes, Mexico, on its leak site. The listing appeared on Oct 26, 2026 (UTC). The group has not shared details on the volume or type of data allegedly taken. Context: On Oct 14, 2026, local media reported that the UAA detected intrusion attempts on its servers that disrupted institutional email, its E-SSIMA student platform and its virtual classroom. The university said at the time that no data had been extracted. Whether that incident is linked to this claim is not confirmed. ⚠️ Analyst Note: Universities hold student, staff and applicant records. If the claim holds, students and staff should expect university-themed phishing and should not open unexpected attachments or password reset links. Unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #SafePay #Ransomware #UAA #Aguascalientes #Mexico #Education #ThreatIntelligence #CyberSecurity

🇲🇽 🚨 MEXICO: COLIMA STATE GOVERNMENT DATABASE ALLEGEDLY EXPOSED, 720K RECORDS A threat actor on an underground forum has posted what they claim is a database belonging to the Gobierno de Colima, the state government of Colima, Mexico. The listing title claims the dataset contains about 720,000 records. The visible part of the listing does not specify which data fields, systems or time period are involved. The claim has not been independently verified. ⚠️ Analyst Note: State government databases can hold citizen, taxpayer or public-servant records, so a 720K-record set could carry real phishing and fraud risk if authentic. However, the post shows no field list or sample here, and government datasets are often repackaged from older leaks or public portals. Unverified threat-actor claim, NOT confirmation of a compromise of Colima state government systems. Source: this is for subscribers only. Subscribe: xitter.cf/DailyDarkWeb/creator-s… #DDW #DarkWeb #Mexico #Colima #DataBreach #Government #ThreatIntelligence

🌎 🚨 THE GENTLEMEN RANSOMWARE LISTS SAP LATIN AMERICA The Gentlemen ransomware group has added SAP to its leak site, describing the victim as SAP Latin America and Caribbean, the regional arm of the German enterprise software giant that runs operations across about 10 countries, with Brazil as its largest market. The listing appeared on Oct 26, 2026 (UTC). The group has not shared details on the volume or type of data allegedly taken. It comes two days after a separate, unrelated actor claimed a 31 GB leak tied to SAP's Ecuador operations. The claim has not been independently verified, and SAP has not publicly confirmed a cyber incident. ⚠️ Analyst Note: A regional SAP unit holds customer contracts, project files and partner data for thousands of large enterprises. If the claim holds, SAP customers and integrators in the region should watch for SAP-themed phishing and fake invoice or support requests. Unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #TheGentlemen #Ransomware #SAP #LatinAmerica #Brazil #ThreatIntelligence #CyberSecurity