Base de residência de Kirkuk · Breach

Threat actor claims leak of 2026 Kirkuk residency database

Nov 02, 2026 · 1 min read

A threat actor posted on an underground forum a sample it claims comes from the 2026 Kirkuk residency database in Iraq. The claimed records include full names, mothers' names, dates and places of birth, phone numbers, full addresses and national, civil status and residency card numbers. The claim is unverified, no Iraqi authority has confirmed an incident and the record count is unknown; people named should watch for phishing, identity fraud and SIM-swap scams.

By HIFY Radar newsroom Updated 11/02/2026 11:09 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A threat actor posted on an underground forum a sample it claims is from the 2026 Kirkuk residency database in Iraq. The claimed data covers full identification, phone numbers, addresses and ID numbers. The claim is unverified and no Iraqi authority has confirmed an incident.

Why it matters

If genuine, this is a highly sensitive civil-registry dataset, according to the source's analyst note. Kirkuk is an ethnically mixed, politically contested province, and fields flagging minority status and martyr families could expose residents to targeting, identity fraud and SIM-swap scams. The record count and the source system are unknown.

What to do

Watch for official confirmation and tell anyone named to be alert to phishing, identity fraud and SIM-swap scams. Strengthen identity verification in any process that relies on personal data.

For the technical team

Affected: Base de residência de Kirkuk (Iraque) referente a 2026; amostra alegada publicada por ator de ameaças em fórum subterrân · Kirkuk residency database (Iraq), dated 2026; record count unknown.
Exploitation: Claim by a threat actor on an underground forum, with a sample posted. Not independently verified; no Iraqi authority has confirmed an incident.
Fix: Not applicable to a data leak.
Vector: Not stated. The source says the system the data came from is unknown.
More details: Fields claimed in the listing: gender, marital status, spouse details, number of children, minority-group membership, special needs and martyr family status; address broken down to district, sub-district, neighborhood and house number. Reported by DailyDarkWeb. The source's analyst note warns of targeting, identity fraud and SIM-swap scams in an ethnically mixed, politically contested province.