Cooperativa de Ahorro y Crédito Juan Pío de… · Breach

[Single source] Claim: Actor Offers Juan Pío de Mora Data and Access

Nov 12, 2026 · 1 min read

A threat actor claims to be selling data and access tied to Ecuadorian credit union Juan Pío de Mora, including about 9 GB of compressed bank records and persistent remote access. The claim is unverified and does not confirm a breach. Members should monitor suspicious transactions and phishing attempts.

By HIFY Radar newsroom Updated 11/12/2026 12:41 AM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Alleged

DailyDarkWeb reports that an unidentified threat actor claims to be selling data and continuing access tied to Ecuadorian credit union Juan Pío de Mora. The supplied evidence does not independently confirm a breach or show that the advertised material and access are genuine.

What happened

Alleged

According to DailyDarkWeb, the seller advertised an approximately 9 GB compressed archive of bank records, persistent remote access to a web-banking server, access privileges, internal service lists, server mapping and a database. These details come from a relayed threat-actor claim, not direct verification from the credit union.

Why it matters

Alleged

DailyDarkWeb's analyst note says that, if the claimed live access is real, it could increase the risk of fraud against members. Information presented as internal banking data could also make phishing attempts more convincing.

What to do

Inferred

DailyDarkWeb advises members to watch for suspicious transactions and phishing. Given the unverified status of the claim, customers should treat unexpected messages requesting credentials or financial information cautiously rather than assuming every message is connected to this incident.

Confirmed and still uncertain

Observed

What is known is that DailyDarkWeb published the allegation and explicitly labeled it unverified. The evidence does not establish whether Juan Pío de Mora was compromised, whether the archive contains authentic records, whether access remains active, who the seller is or whether any customer suffered fraud.

What people are saying

Observed

DailyDarkWeb describes the case as an alleged breach and warns that the purported server access would be especially concerning if authentic. No statement from Juan Pío de Mora, regulators, law enforcement or an independent security investigator appears in the supplied evidence.

Evolution

Observed

The available chain begins with an unidentified actor's purported sales offer and continues with DailyDarkWeb relaying its contents. The same post adds an analyst warning but also stresses that the allegation is not confirmation of a breach; no later validation or response is included.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The actor allegedly offered persistent remote access to a web-banking server alongside privileges, service inventories, server mapping and database access. The evidence provides no exploit method, affected software, indicators of compromise or technical proof that these capabilities exist.

Sources and evidence

Observed

The only substantive evidence supplied is a DailyDarkWeb post summarizing a subscriber-only source and reproducing the alleged seller's claims. It includes a related image, but no direct threat-forum listing, sample records, forensic findings or confirmation from the credit union, so the central allegation remains unverified.