Fersumac.net Database Leak Exposes Spanish User Info

Data Breach Summary

A significant breach involving the Spanish tobacco machinery company Fersumac.net surfaced on the dark web in September 2025. Shared by a user named wizard on DarkForums, the leaked data includes highly sensitive information from the company’s customer database. This breach exposes hundreds of records containing hashed passwords, emails, full names, addresses, phone numbers, and tax identification numbers (DNI/VAT), pointing to a serious compromise of client data.

---

Where and How?

The leak was published on the dark web forum darkforums.st, where a user shared a CSV file containing personal and business details of Fersumac clients. Among the leaked fields are:

• Full names
• Email addresses
• Hashed passwords
• Physical addresses
• DNI and VAT numbers
• Phone numbers
• Company aliases

The data structure indicates a direct database extraction, possibly due to poor server security or exposed endpoints. The presence of hashed passwords suggests the attackers gained backend access to internal systems, likely tied to Fersumac’s client management platform.

Company Data Breach History

There is no public record of previous breaches associated with fersumac.net. However, this recent exposure highlights critical vulnerabilities in the company’s data protection strategy. Immediate action is required to strengthen database security and prevent future incidents.

---

Further Action

Fersumac should promptly investigate the source of the breach, notify all affected individuals, and ensure compliance with Spanish and EU data protection laws (including GDPR). Security measures such as encryption, restricted access, and routine vulnerability assessments must be prioritized moving forward.

How Users Can Protect Their Information

• Immediately change passwords associated with the leaked emails.
• Avoid reusing passwords across multiple platforms.
• Enable two-factor authentication where available.
• Watch for phishing attempts targeting the leaked information.
• Regularly review banking and email accounts for suspicious activity.

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.