BRIEFGov / MilitarycriticalP90
Defacement and database leak of Peru's SATICA.gob.pe portal
SATICA.gob.pe
Detected31 October 2026 · 22:24 UTC
A forum user 'cyk', presenting as SoulHemTeam | GrimGroup, posted on Spear Leaks a defacement plus database dump of SATICA.gob.pe, a Peruvian government portal. Compromise of a .gob.pe site signals an exposed web application and likely theft of citizen or staff records; government sites sharing the same stack should be reviewed urgently.
CategoryGov / Military
Severitycritical
Priority score90
Detected31 October 2026 · 22:24 UTC
Gov / Military● 48
Datos de estudiantes del Ministerio de Educación de Marruecos filtradosDarkForums user Jorzosek posted on 31 October 2026 a dataset described as Moroccan student data from the Ministry of Education. Education records usually contain minors' names, school identifiers and guardian contacts, which are sensitive for identity fraud and social-engineering attacks on families. The volume is not stated and the claim remains unverified.Gov / Military● 58
Filtración de datos del Ministerio de Salud de ChinaDarkForums user Wyrnudor posted on 31 October 2026 a dataset presented as leaked data from China's Ministry of Health. Health ministry records can include personnel, facility and patient-adjacent information, making them attractive for espionage, fraud and further targeting of public health infrastructure. The claim is unverified and a related thread on the National Health Commission appeared the same day.Gov / Military● 60
Filtración de datos del Parlamento de PakistánDarkForums user Jartezon published on 31 October 2026 a dataset described as leaked data from the Parliament of Pakistan. Legislative bodies hold staff, contractor and sometimes security-related records, so exposure can enable targeting of officials and further intrusions into government networks. Confidence in the claim is limited because no sample details were verified in the collected text.Gov / Military● 72
Segundo reporte del defacement y volcado de datos del SATICA de IcaA second DarkForums thread republishes documents and data allegedly taken from SATICA, the tax administration service of Ica, Peru, corroborating the defacement reported the same day on Spear Leaks. Duplicate postings usually accompany data samples meant to prove access, suggesting the operators are seeking attention or buyers for the stolen records. This reinforces that the incident is being actively publicised and that taxpayer data may already be circulating.Gov / Military● 88
Defacement del portal SATICA de la administración tributaria de Ica, PerúActors identifying as SoulHemTeam and GrimGroup announced the defacement of satica.gob.pe, the tax administration service of the Peruvian province of Ica, posting it on Spear Leaks roughly two hours before collection. The thread claims both site takeover and a database dump, which would expose taxpayer records and municipal revenue systems. A live compromise of a .gob.pe tax authority is a high-priority incident with direct fraud and service-disruption risk for citizens.Gov / Military● 93
Defacement del portal gubernamental peruano SATICA.GOB.PEThe crew SoulHemTeam/GrimGroup published on the Spear Leaks forum, on 31 October 2026, a defacement of SATICA.GOB.PE, a Peruvian government web portal, framed as a database leak of the compromised site. The thread claims successful intrusion and offers the defacement as proof, exposing a public-sector service to citizens. Defacements of .gob portals are frequently a by-product of deeper intrusion, so Peruvian public-sector defenders should treat this as an active incident rather than vandalism.