Actor claims leak of 11.4 million Mexico City resident records
A threat actor posted on a dark web forum a database they claim holds 11.4 million Mexico City resident records, about 1.36 GB, with names, CURP IDs, dates of birth, gender, employment status and addresses. The claim is unverified: the original source has not been identified and no Mexico City authority has confirmed an incident, according to DailyDarkWeb, which warns the data may be recirculated from older leaks. Treat it as a claim, watch for official confirmation and check your own data exposure.
What happened
A threat actor posted on a dark web forum a database they claim holds 11.4 million Mexico City resident records, about 1.36 GB. The data would include full names, CURP national ID numbers, dates of birth, gender, employment status and home addresses. The claim is unverified and no authority has confirmed an incident.
Why it matters
If genuine, the dataset combines a national ID and home addresses at million-record scale, raising identity fraud and targeted phishing risk for those residents, according to DailyDarkWeb. The same report warns that Mexican citizen datasets are often recompiled from older leaks, so this may include recirculated data.
What to do
Treat this as an unverified claim until official confirmation. Watch Mexico City channels for confirmation and check whether customer or employee data appears in the posted set. Strengthen fraud and phishing defenses for affected populations.
For the technical team
- Affected
- Base de dados alegada de moradores da Cidade do México com números CURP (identificação do registro nacional de população · Alleged database of Mexico City resident records with CURP IDs; no specific product or system identified.
- Exploitation
- No exploitation reported. Claim posted by a threat actor on a dark web forum and reported by DailyDarkWeb; unverified, with no authority confirmation and no identified original source. DailyDarkWeb classified it as an unverified claim, not confirmation of a breach.
- Fix
- Not applicable: alleged leak with no patchable product identified in the sources. Suggested mitigation: exposure checks and monitoring for official confirmation.
- Vector
- Not described in the sources. The original source of the data has not been identified.
- More details
- DailyDarkWeb states Mexican citizen datasets are often recompiled from older leaks, so the database may include recirculated data. If genuine, CURP plus address data at this scale raises identity fraud and targeted phishing risk. Alleged volume: 11.4 million records, about 1.36 GB. Incident opened 2026-10-28.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
