BRIEFGov / MilitaryhighP63
Argentina RENAPER national ID (DNI) database leaked, ~19M people
RENAPER (Registro Nacional de las Personas, Argentina)
Detected8 November 2026 · 19:43 UTC
A DarkForums thread offers roughly 19M full personal records from Argentina's RENAPER national identity registry, including DNI data. RENAPER underpins national ID issuance, so this data fuels identity fraud, account takeover and government-service impersonation. No fresh date is visible and it closely resembles the historic 2021 RENAPER breach, so it may be a reposted dataset rather than a new compromise.
CategoryGov / Military
Severityhigh
Priority score63
Detected8 November 2026 · 19:43 UTC
Gov / MilitaryPriority 90
Base de datos del RENAPO de México a la ventaThreat actor 'cutzinger' is advertising on DarkForums what is claimed to be a database from Mexico's RENAPO national population and identity registry. RENAPO holds CURP, full names, birth dates and identity records for the entire Mexican population, so a genuine dump enables mass identity fraud and impersonation. Mexican government bodies and financial institutions should urgently verify authenticity and assess exposure.Gov / MilitaryPriority 85
Filtración de base de datos de la Secretaría de Educación de MichoacánA database belonging to the Secretaría de Educación de Michoacán (Mexico) is being leaked on DarkForums by the user 'arcepah', exposing records tied to the state's public education ministry. Leaked government education data directly enables identity fraud, targeted phishing of public employees and further intrusion into .gob.mx systems. Mexican public-sector defenders should treat this exposure as confirmed and closely monitor for credential reuse and follow-on attacks.Gov / MilitaryPriority 88
Base de datos de la Policía Civil de São Paulo a la ventaA threat actor is selling a database allegedly belonging to the São Paulo Civil Police (Polícia Civil de São Paulo), a Brazilian state law-enforcement agency, on BreachForums' leak marketplace. Police records typically include officer and citizen PII, case data and identifiers that enable targeted fraud, doxxing and attacks on law-enforcement personnel. This is a high-value government target in Latin America and warrants urgent validation and containment.Gov / MilitaryPriority 90
Filtración de base de datos del SAT de Ica, Perú (satica.gob.pe)A DarkForums leak advertises a database from satica.gob.pe, the Peruvian municipal tax administration service (SAT) of Ica, containing DNI national IDs, RUC tax numbers, contracts and invoices. This is direct exposure of citizen and government records tied to a real .gob.pe domain. Such data enables identity fraud and targeted attacks against the tax authority and local businesses.Gov / MilitaryPriority 90
Base de datos fiscal completa del SAT de Ica (Perú) a la ventaA threat actor on DarkForums is selling the full tax database of Peru's SAT Ica (satica.gob.pe), including DNI, RUC, contracts and invoices. Leaked national ID and taxpayer records enable identity theft, tax fraud and targeted phishing. It is a direct hit on a Peruvian government tax authority.Gov / MilitaryPriority 88
Filtración de 40.000 registros de la Comisión Nacional de ValoresAn actor on DarkForums is offering 40,000 records allegedly from Argentina's National Securities Commission (CNV), the country's financial market regulator. The leak reportedly includes internal documents exposing staff and operational details. Compromise of a financial oversight body enables targeted phishing against brokers and other state financial entities.