Instituto de Salud del Estado de Chiapas… · Breach

Actor claims breach of Chiapas health institute, 500K records

Oct 29, 2026 · 1 min read

A threat actor claims on a dark web forum to have breached the Instituto de Salud del Estado de Chiapas, the public health body of Mexico's Chiapas state, and taken about 500,000 records. The post says the data includes CURP and RFC numbers, contact details, tax information and employment details, as detailed JSON profiles with exact locations; a sample schema was shared as proof. The claim is unverified and the institute has not commented; if genuine, it raises identity-theft and fraud risk.

By HIFY Radar newsroom Updated 10/29/2026 05:26 AM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A threat actor on a dark web forum claims to have breached the public health body of Mexico's Chiapas state and taken about 500,000 records. The post shares a sample data schema as proof. The institute has not commented and the claim is unverified.

Why it matters

If confirmed, the leak would expose national ID (CURP) and tax ID (RFC) numbers of health-sector staff, plus contact, tax and employment details. That opens the door to identity theft and fraud against those people.

What to do

Treat it as an unverified claim. Monitor leak forums and channels for confirmation or larger data samples. Prepare communications in case it is confirmed.

For the technical team

Affected: Instituto de Salud del Estado de Chiapas Sistemas do Instituto de Salud del Estado de Chiapas, órgão de saúde pública do estado de Chiapas (México); alegado vaza · Systems of the Instituto de Salud del Estado de Chiapas, the public health body of Mexico's Chiapas state. No specific system or version named.
Exploitation: No confirmed exploitation. Unverified threat-actor claim on a dark web forum, reported by DailyDarkWeb. A sample data schema was shared as proof.
Fix: Not applicable.
More details: Alleged data: CURP and RFC numbers, contact details, tax information and employment details, as detailed JSON profiles with exact locations. Source: DailyDarkWeb post on a dark web forum. The institute has not commented.