Actor claims dump of 66K clients from Barcelona's Club Natació Montjuïc
A threat actor on an underground forum claims administrator access to Club Natació Montjuïc, a swimming and sports club in Barcelona, and says it dumped the client database. The claim covers more than 66,000 records with names, phone numbers, emails, postal addresses and membership data, plus access to the admin panel for payments and invoices. The claim is unverified and the club has not confirmed an incident; members should watch for fake membership-renewal or payment messages.
What happened
A threat actor on an underground forum claims administrator access to Club Natació Montjuïc, a sports club in Barcelona, and says it dumped a database of more than 66,000 clients. The claim includes names, phone numbers, emails, postal addresses and membership data, plus access to payments, invoices and the cash register. The club has not confirmed an incident and the claim has not been independently verified.
Why it matters
If authentic, family membership data, possibly including children, would be exposed and provide convincing material for renewal and payment scams aimed at members. The claimed admin-panel access would also put the club's payment and invoicing functions at risk.
What to do
Wait for an official statement from the club before treating this as fact. Members should change club-portal passwords and be wary of messages requesting renewal or payment. Club teams should review admin accounts and access logs.
For the technical team
- Affected
- Club Natació Montjuïc Base de clientes do Club Natació Montjuïc, clube de natação e esportes de Barcelona · Club Natació Montjuïc, a swimming and sports club in Barcelona: client database and admin panel, per the claim. No software versions cited.
- Exploitation
- No confirmed exploitation. Threat-actor claim on an underground forum, reported by DailyDarkWeb; not independently verified and the club has not confirmed an incident. The actor offers a 1,000-record free preview.
- Fix
- No fix or mitigation cited in the sources. The club has not confirmed an incident.
- Vector
- Component and method not described in the sources. Claimed administrator access to the club's system, including the admin panel for payments, invoices and the cash register.
- More details
- The claim cites over 66,000 records; the thread title says 62.3K+. Claimed fields: names, phone numbers, emails, postal addresses, membership status, registration dates and reference numbers. DailyDarkWeb notes sports clubs hold family memberships, so the dump may include data on children, and that contact details tied to a local club are ideal for membership-renewal or payment phishing.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
