Actor claims sale of 1.5 million Virgen del Cisne records
A threat actor is advertising on an underground forum the sale of about 1.5 million records from Cooperativa de Ahorro y Crédito Virgen del Cisne, an Ecuadorian savings and credit cooperative, according to DailyDarkWeb. The claim includes names, ID numbers, passwords, bank accounts, transaction data, biometric codes and cloud access, and a shared sample appears to show member data. The cooperative has not confirmed an incident; members should change passwords, watch their accounts and treat unexpected requests for codes as fraud.
What happened
A threat actor advertised on an underground forum the sale of about 1.5 million customer records from Ecuador's Cooperativa Virgen del Cisne, according to DailyDarkWeb. The claim covers names, ID numbers, passwords, bank accounts, transaction data and biometric codes. The cooperative has not confirmed an incident.
Why it matters
If confirmed, the dataset exposes members to identity fraud, account takeover and phishing calls posing as the cooperative, per DailyDarkWeb's analyst note. The claimed cloud access would suggest a deeper compromise of backend systems. Such data at a financial institution carries regulatory and reputational risk.
What to do
Await an official statement from the cooperative and monitor threat intelligence channels for confirmation. Members should change passwords, enable two-factor authentication and treat unexpected requests for codes or passwords as fraud. If confirmed, the cooperative should investigate the cloud access and notify regulators and members.
For the technical team
- Affected
- Cooperativa de Ahorro y Crédito Virgen del Cisne Base de dados da Cooperativa de Ahorro y Crédito Virgen del Cisne, cooperativa de poupança e crédito do Equador; cerca d · Customer database of Cooperativa de Ahorro y Crédito Virgen del Cisne (Ecuador); about 1.5 million records claimed.
- Exploitation
- No confirmed exploitation. Underground forum sale claim reported by DailyDarkWeb; a sample shared by the actor appears to show member names, ID numbers, emails and phone numbers.
- Fix
- No software fix applicable. Stated mitigation: change passwords, enable two-factor authentication and monitor accounts.
- Vector
- Compromise method not described in the source; the actor claims to hold cloud access to the cooperative.
- More details
- Data claimed by the actor: names, ID numbers, emails, phone numbers, home addresses, passwords, bank account numbers, transaction data, biometric codes, cloud access, scanned documents, photos and PDF/Excel/Word files. DailyDarkWeb rates the case as an unverified threat-actor claim, not confirmation of a breach; the cooperative has not confirmed an incident as far as the source knows. Incident opened October 28, 2026.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
