BRIEFGov / MilitaryhighP88
Data leak of 17,000 citizens from Irapuato government, Mexico
Gobierno de Irapuato (México)
Detected17 September 2026 · 17:12 UTC
Reposts collapsed2
A database with 17,000 complete records from Irapuato's municipal government job-board portal was published, exposing personal data of citizens who applied. Mexican government portals handling employment or benefit data are prime targets for tax-fraud and identity-theft campaigns. The leak should be confirmed and affected individuals notified.
CategoryGov / Military
Severityhigh
Priority score88
Detected17 September 2026 · 17:12 UTC
Gov / Military● 90
Defacement y filtración de la base de datos de SATICA.gob.pe (Perú)A forum user 'cyk', presenting as SoulHemTeam | GrimGroup, posted on Spear Leaks a defacement plus database dump of SATICA.gob.pe, a Peruvian government portal. Compromise of a .gob.pe site signals an exposed web application and likely theft of citizen or staff records; government sites sharing the same stack should be reviewed urgently.Gov / Military● 48
Datos de estudiantes del Ministerio de Educación de Marruecos filtradosDarkForums user Jorzosek posted on 31 October 2026 a dataset described as Moroccan student data from the Ministry of Education. Education records usually contain minors' names, school identifiers and guardian contacts, which are sensitive for identity fraud and social-engineering attacks on families. The volume is not stated and the claim remains unverified.Gov / Military● 58
Filtración de datos del Ministerio de Salud de ChinaDarkForums user Wyrnudor posted on 31 October 2026 a dataset presented as leaked data from China's Ministry of Health. Health ministry records can include personnel, facility and patient-adjacent information, making them attractive for espionage, fraud and further targeting of public health infrastructure. The claim is unverified and a related thread on the National Health Commission appeared the same day.Gov / Military● 60
Filtración de datos del Parlamento de PakistánDarkForums user Jartezon published on 31 October 2026 a dataset described as leaked data from the Parliament of Pakistan. Legislative bodies hold staff, contractor and sometimes security-related records, so exposure can enable targeting of officials and further intrusions into government networks. Confidence in the claim is limited because no sample details were verified in the collected text.Gov / Military● 72
Segundo reporte del defacement y volcado de datos del SATICA de IcaA second DarkForums thread republishes documents and data allegedly taken from SATICA, the tax administration service of Ica, Peru, corroborating the defacement reported the same day on Spear Leaks. Duplicate postings usually accompany data samples meant to prove access, suggesting the operators are seeking attention or buyers for the stolen records. This reinforces that the incident is being actively publicised and that taxpayer data may already be circulating.Gov / Military● 88
Defacement del portal SATICA de la administración tributaria de Ica, PerúActors identifying as SoulHemTeam and GrimGroup announced the defacement of satica.gob.pe, the tax administration service of the Peruvian province of Ica, posting it on Spear Leaks roughly two hours before collection. The thread claims both site takeover and a database dump, which would expose taxpayer records and municipal revenue systems. A live compromise of a .gob.pe tax authority is a high-priority incident with direct fraud and service-disruption risk for citizens.