Actor claims Honduras foreign ministry breach, 40,127 records exposed
A threat actor using the handle 'GordonFreeman' claims on an underground forum to have breached Honduras' Ministry of Foreign Affairs through an exposed API, obtaining 40,127 records from internal systems. The post says the 58.5 MB dataset holds names, emails, phone numbers, national IDs, residential data, and password hashes, and a 5,000-record sample was published. The claim is unverified, the ministry has not commented, and the actor warns of more attacks on Honduran institutions.
What happened
A threat actor using the handle 'GordonFreeman' claims on an underground forum to have breached Honduras' Ministry of Foreign Affairs through an exposed API. The actor says 40,127 records were pulled from internal systems, and posted a 5,000-record sample plus a 58.5 MB file as proof. The claim is unverified and the ministry has not commented.
Why it matters
If genuine, the dataset exposes sensitive personal data, such as national ID numbers and password hashes, creating identity fraud and account takeover risk for staff and citizens. The actor also announces a series of attacks on other Honduran institutions, which could disrupt public services and public trust in government.
What to do
Immediately investigate and restrict external access to the cited API, and review internal system access logs. Validate whether the leaked dataset is real and, if so, prepare credential resets and notification to affected people.
For the technical team
- Affected
- Ministério das Relações Exteriores de Honduras Sistemas internos do Ministério das Relações Exteriores de Honduras, acessados via API exposta; base alegada de mais de 40 mil registros com e-mails, telefones, números de cédula e hashes de senhas · Internal systems of the Honduran Ministry of Foreign Affairs (Cancillería). No specific product or version cited in the sources.
- Exploitation
- Underground forum claim only, reported by @DarkWebInformer and @DailyDarkWeb; no confirmation from the ministry. The actor published a 5,000-record sample as proof. No mention of KEV or exploitation by other groups.
- Fix
- No fix cited in the sources. Suggested mitigations: restrict the exposed API, investigate unauthorized access, and reset passwords if the breach is confirmed.
- Vector
- Exposed API, per the actor's claim; the interface allegedly allowed pulling a database from the ministry's internal systems. The sources give no details on authentication or a specific endpoint.
- More details
- Actor identified by the handle 'GordonFreeman' (source: @DarkWebInformer). The alleged dataset is 58.5 MB, with names, emails, phone numbers, national IDs, residential data, and password hashes; @DailyDarkWeb cites a roughly 58 MB JSON file shared as proof. The actor says this is the first in a planned series of attacks on Honduran institutions. @DailyDarkWeb classifies the case as an unverified threat-actor claim and assesses identity theft and account takeover risk if the hashes are cracked.
Timeline
New post details the claim: a database of over 40,000 records with emails, phone numbers, national IDs and password hashes, plus a sample and a 58 MB JSON file shared.
Incident opened.
Sources 2 sources
- @DarkWebInformer @DarkWebInformer
- @DailyDarkWeb @DailyDarkWeb
