Comprobantes Fiscales Electrónicos · Breach

Actor Allegedly Leaks 1.5M Electronic Tax Invoices from Uruguay

Oct 28, 2026 · 1 min read

A threat actor posted on a dark web forum a database claimed to hold 1.5 million records from Uruguay's mandatory electronic tax invoices (CFE), with names, emails, RUT tax IDs, transaction logs, invoice totals and bank account numbers. The claim is unverified, the source system is unclear, and Uruguay's tax authority (DGI) has not commented, per DailyDarkWeb. If genuine, the data could fuel invoice fraud, business email compromise and tax-related scams.

By HIFY Radar newsroom Updated 10/28/2026 09:31 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A threat actor posted on a dark web forum a database claimed to hold 1.5 million records from Uruguay's mandatory electronic tax invoices (CFE). Per the post, the data includes names, emails, RUT tax IDs, transaction logs, invoice totals and bank account numbers of businesses and customers. The claim is unverified, and Uruguay's tax authority (DGI) has not commented, per DailyDarkWeb.

Why it matters

If genuine, the data could fuel invoice fraud, business email compromise and tax-related scams against businesses and customers, per DailyDarkWeb's analysis. Exposed bank account numbers and transaction details enable attacks targeting finance teams. The original system the data came from is unclear.

What to do

Monitor bank accounts and verify any supplier payment-detail change through an independent channel. Brief finance and customer service teams on scams that use real tax data. Watch for a possible DGI statement on the claim.

For the technical team

Affected: Comprobantes Fiscales Electrónicos (CFE), sistema de notas fiscais eletrônicas obrigatórias do Uruguai; base alegada de · Alleged database of records from Comprobantes Fiscales Electrónicos (CFE), Uruguay's mandatory electronic tax invoices. Source system unidentified.
Exploitation: No exploitation reported. Posted on a dark web forum by an unnamed actor, reported by DailyDarkWeb. Claim unverified.
Fix: No fix applicable; no software vulnerability identified.
Vector: Alleged data leak, no technical intrusion details. The original system the data came from is unclear, per DailyDarkWeb.
More details: Shared samples reportedly show detailed transaction logs, invoice totals and bank account numbers. Records are shared as XML fiscal documents with metadata. Per DailyDarkWeb, if genuine, the leak could fuel invoice fraud, BEC and tax-related scams. DGI has not commented.