The FulldbSQLi Spain Dump Exposed 90,874 Login Records From Spain

HEROIC analysts found this file on Telegram on March 21, 2026. The uploader's file name, FulldbSQLi_106k_USER_PASS_HQ_Private_Duplicate_Removed_ES_Spain, suggests around 106,000 records, but the verified count in this file after duplicates were removed is 90,874 email and plaintext password pairs, with login URLs pointing to Spain-linked accounts. Why This Is Dangerous: The SQLi label points to SQL injection, meaning attackers likely pulled this data directly from a poorly secured website database rather than gathering it one login at a time. Combined with plaintext passwords, the roughly 90,874 records here are ready for an attacker to use the moment they open the file. What Was Exposed: - Email addresses - Plaintext passwords - Login URLs Why This Matters: At nearly 91,000 records, this file affects a large number of people at once. Anyone in this file who reused their password elsewhere faces a real risk of credential stuffing, where the same email and password is tested across many other sites, potentially leading to account takeover, identity theft, or financial fraud. How a SQL Injection Dump Like This Works: In a SQL injection attack, a hacker finds a flaw in a website's database code and uses it to pull out entire tables of stored user data at once, including usernames, emails, and passwords. The stolen data is then cleaned up and deduplicated, exactly as the file name here describes, before being shared or resold. Check If You Are Affected: HEROIC's free breach scanner checks your email against more than 400 billion breached and leaked records. Run a free scan to see if you were part of this leak.