Prefeitura de Solidaridad · Breach

[Single source] Actor claims leak of Playa del Carmen municipal database

Nov 10, 2026 · 1 min read

A threat actor posted on a dark web forum a database claimed to be from the municipal government of Solidaridad (Playa del Carmen), Quintana Roo, covering residents who filed permits and property-tax procedures online. The sample includes names, emails, phone numbers, home addresses, RFC tax IDs, property cadastral keys and hashed portal passwords. The claim is unconfirmed by the municipality.

By HIFY Radar newsroom Updated 11/10/2026 01:09 AM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Alleged

A threat actor on a dark web forum claims to have leaked a database from the municipal government of Solidaridad, the municipality that covers Playa del Carmen in Quintana Roo, Mexico. According to the post, the file relates to residents who filed permits and property-tax procedures online.

Alleged

A sample attached to the claim lists names, emails, phone numbers, home addresses, RFC tax IDs, property cadastral keys, hashed portal passwords, payment details and documents described as scans of the INE voter ID. None of this is confirmed. The tracker that surfaced the post calls it an unverified threat-actor claim, and the municipality had said nothing as of the report.

What happened

Alleged

The public trail begins with a forum post. A threat actor presented a database and said it came from the municipal government of Solidaridad, covering people who used the municipality's online services for permits and property-tax procedures. That attribution rests entirely on the actor's word.

Alleged

The sample that accompanies the claim is what gives it weight. It shows names, emails, phone numbers and home addresses, alongside RFC tax IDs, property cadastral keys, hashed passwords for the municipal portal, payment details and documents described as INE voter ID scans.

Observed

One concrete detail stands out. According to the analyst who reviewed the material, timestamps in the sample cluster around September 2024, which is the only internal dating evidence public so far.

Why it matters

Inferred

The combination is what worries analysts. The INE credential is the standard photo ID in Mexico, and a scan of it paired with an RFC tax ID, a home address and a phone number gives a fraudster most of a kit for impersonating someone. DailyDarkWeb calls material like this prime fodder for identity fraud.

Inferred

There is also a phishing angle. The people in this dataset filed permits or property-tax paperwork online, so they expect to hear from the municipality. A message themed around a pending permit or an overdue property-tax payment would not look out of place to them.

What to do

Inferred

Until Solidaridad confirms or denies the leak, residents who used the online portal should be skeptical of unsolicited messages about permits or property tax. Go to official channels directly instead of clicking links, and treat any request for RFC, INE or payment details as suspicious.

Inferred

The sample includes hashed portal passwords, not plaintext ones, but hashes can sometimes be cracked offline depending on the algorithm. Anyone who reused the portal password on other accounts has a reason to change it there too.

Confirmed and still uncertain

Observed

What is established so far is narrow. A forum post exists, a sample accompanies it, the sample's timestamps cluster around September 2024, and the tracker that surfaced all this explicitly labels the claim unverified. No statement from the municipality appears in the available material.

Inferred

The open questions are the big ones: whether the database really comes from municipal systems, how many people it covers, how current the records are, and whether the full file has actually been distributed beyond the forum.

What people are saying

Observed

Only one voice is on the record here. DailyDarkWeb, an account that monitors dark web forums, reported the claim on X and attached an explicit caution of its own: this is an unverified threat-actor claim, not confirmation of a breach.

Observed

The other parties are silent so far. The municipal government of Solidaridad had issued no public statement as of the report, and no independent security researcher or official source appears in the available evidence.

Evolution

Observed

The public timeline is short. The claim appeared on a dark web forum, and DailyDarkWeb then carried it to a wider audience on X in November 2026, complete with a screenshot and a description of the sample.

Inferred

The sample's timestamps suggest a longer backstory. If the dates around September 2024 reflect when the data was collected, any underlying breach would have happened more than two years before the public claim, which would fit a familiar pattern: data circulates privately long before someone advertises it.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

Per the post and its sample, each record bundles identity data with fiscal and property data. That means name, email, phone and home address, plus the RFC, Mexico's federal taxpayer ID, and the cadastral key, the unique identifier assigned to a property for tax purposes. Payment details, hashed passwords for the municipal portal and documents described as INE scans round out the file.

Observed

Two technical caveats matter. The passwords are hashed rather than stored in plain text, and the reporting does not say which algorithm was used, so their real exposure is unknown. The sample's timestamps cluster around September 2024, which is the only internal dating evidence on the table.

Sources and evidence

Observed

This item rests on a single public source: a post by DailyDarkWeb on X that includes a screenshot of the alleged forum listing. The account itself flags the material as an unverified threat-actor claim and notes that the data may be older than the post suggests.

Inferred

Confirmation would need something the current batch lacks. A statement from the municipality of Solidaridad, an independent review of the full dataset, or a technical link between the sample and municipal systems would all move the story. Until one of those appears, the leak stays in the category of plausible but unproven.