Colombia's National Learning Service · Breach

[Single source] Threat actor claims leak of 20,564,434 SENA records

Nov 08, 2026 · 1 min read

The threat actor KOIII is offering a database allegedly obtained from SENA containing 20,564,434 records and has published samples, but the exposure has not been independently verified. Separately, SENA acknowledged possible unauthorized modification and extraction of information from its APE platform. Organizations should identify APE users and monitor official SENA communications.

By HIFY Radar newsroom Updated 11/08/2026 04:54 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In 30 seconds

Alleged

An X post reports that an actor known as “KOIII” is selling a database allegedly obtained from Colombia’s National Learning Service (SENA), claiming it contains 20,564,434 records. The claimed exposure has not been independently verified.

What happened

Alleged

According to the post, the actor published samples and offered a purported SENA database for sale. The post also says SENA separately disclosed a November 5 security incident involving its Public Employment Agency (APE) platform and acknowledged possible unauthorized modification and extraction of information.

Why it matters

Inferred

If authentic, the combination of identity, contact, employment, and education data could enable targeted phishing, impersonation, fraud, or other forms of social engineering against affected people.

What to do

Inferred

People who have provided information to SENA or APE should treat unexpected messages requesting credentials, payments, or identity confirmation with caution, verify communications through official channels, and monitor relevant accounts for suspicious activity while the claim remains unconfirmed.

Confirmed and still uncertain

Observed

The supplied evidence establishes that the allegation was posted publicly, but it does not independently establish that the database came from SENA, that it contains 20,564,434 valid records, that the samples are authentic, or that the claimed dataset is connected to the reported APE incident.

What people are saying

Alleged

The post attributes to “KOIII” the claim that the records were cross-referenced with other databases. The post’s author explicitly characterizes the incident as alleged and says the claimed 20.5 million-record exposure has not been independently verified.

Evolution

Alleged

The account places a reported SENA disclosure on November 5 before or alongside the database-sale allegation, but the supplied evidence provides no independently verified timeline of intrusion, extraction, publication, or sale and does not prove that the two events are connected.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Observed

The supplied post mentions possible unauthorized modification and extraction of APE information but provides no intrusion vector, affected systems, access dates, malware indicators, forensic findings, or technical evidence linking the advertised database to SENA.

Sources and evidence

Observed

The evidence batch contains a single X post from DarkWebInformer. It includes no first-party SENA notice, database samples, marketplace listing, forensic report, regulator statement, or independent corroboration, so the central breach and record-count claims remain allegations.