BRIEFGov / MilitarycriticalP92
Municipal government of Chalco, Mexico database posted on DarkForums
Gobierno de Chalco (México)
Detected17 September 2026 · 18:12 UTC
A threat actor posted a database belonging to the municipal government of Chalco, Mexico, on DarkForums, exposing citizen records. Government leaks like this enable identity theft, targeted phishing against public employees and reconnaissance for follow-on intrusions into state systems. Mexican municipal portals are frequent soft targets for local actors.
CategoryGov / Military
Severitycritical
Priority score92
Detected17 September 2026 · 18:12 UTC
Gov / Military● 90
Defacement y filtración de la base de datos de SATICA.gob.pe (Perú)A forum user 'cyk', presenting as SoulHemTeam | GrimGroup, posted on Spear Leaks a defacement plus database dump of SATICA.gob.pe, a Peruvian government portal. Compromise of a .gob.pe site signals an exposed web application and likely theft of citizen or staff records; government sites sharing the same stack should be reviewed urgently.Gov / Military● 48
Datos de estudiantes del Ministerio de Educación de Marruecos filtradosDarkForums user Jorzosek posted on 31 October 2026 a dataset described as Moroccan student data from the Ministry of Education. Education records usually contain minors' names, school identifiers and guardian contacts, which are sensitive for identity fraud and social-engineering attacks on families. The volume is not stated and the claim remains unverified.Gov / Military● 58
Filtración de datos del Ministerio de Salud de ChinaDarkForums user Wyrnudor posted on 31 October 2026 a dataset presented as leaked data from China's Ministry of Health. Health ministry records can include personnel, facility and patient-adjacent information, making them attractive for espionage, fraud and further targeting of public health infrastructure. The claim is unverified and a related thread on the National Health Commission appeared the same day.Gov / Military● 60
Filtración de datos del Parlamento de PakistánDarkForums user Jartezon published on 31 October 2026 a dataset described as leaked data from the Parliament of Pakistan. Legislative bodies hold staff, contractor and sometimes security-related records, so exposure can enable targeting of officials and further intrusions into government networks. Confidence in the claim is limited because no sample details were verified in the collected text.Gov / Military● 72
Segundo reporte del defacement y volcado de datos del SATICA de IcaA second DarkForums thread republishes documents and data allegedly taken from SATICA, the tax administration service of Ica, Peru, corroborating the defacement reported the same day on Spear Leaks. Duplicate postings usually accompany data samples meant to prove access, suggesting the operators are seeking attention or buyers for the stolen records. This reinforces that the incident is being actively publicised and that taxpayer data may already be circulating.Gov / Military● 88
Defacement del portal SATICA de la administración tributaria de Ica, PerúActors identifying as SoulHemTeam and GrimGroup announced the defacement of satica.gob.pe, the tax administration service of the Peruvian province of Ica, posting it on Spear Leaks roughly two hours before collection. The thread claims both site takeover and a database dump, which would expose taxpayer records and municipal revenue systems. A live compromise of a .gob.pe tax authority is a high-priority incident with direct fraud and service-disruption risk for citizens.