Threat actor claims sale of 20.5M SENA citizen records
A threat actor on an underground forum claims to sell 20,564,434 unique records taken from SENA, Colombia's National Learning Service. The claimed data includes full names, national ID numbers, dates of birth, addresses, contacts, academic and internship history, and driver's license details. SENA has not confirmed a breach; treat the claim as unverified and watch for phishing impersonating SENA or employers.
What happened
A threat actor on an underground forum claims to sell 20,564,434 unique records taken from SENA, Colombia's National Learning Service. The claimed data includes full names, national ID numbers, dates of birth, addresses, contacts, academic and internship history, and driver's license details. SENA has not confirmed an incident.
Why it matters
Per DailyDarkWeb's analysis, if genuine, national IDs paired with contact details and career histories for more than 20 million people would fuel identity theft and convincing phishing that impersonates SENA or employers. People connected to SENA face targeted scams using real data.
What to do
Treat the claim as unverified and track SENA's official response. Warn staff about messages that use real personal data and impersonate SENA or employers.
For the technical team
- Affected
- SENA (Serviço Nacional de Aprendizagem da Colômbia) Base de dados de cidadãos atribuída ao SENA, serviço nacional de aprendizagem da Colômbia; 20.564.434 registros únicos o · SENA (Colombia's National Learning Service), per the actor's claim: 20,564,434 unique records with full names, national ID numbers, dates of birth, addresses, phone numbers, emails, academic and internship history, professional profiles, language skills, and driver's license details.
- Exploitation
- Sale announced on an underground forum by a threat actor, reported by DailyDarkWeb. The actor shared a sample record to support the claim; SENA has not confirmed a breach.
- Fix
- Not applicable (alleged data leak; no fix described).
- Vector
- Breach method not described in the sources; only the sale announcement exists.
- More details
- The database would be delivered as JSONL and DB files, with payment requested in Bitcoin. Unverified threat-actor claim with no SENA confirmation, reported by DailyDarkWeb.
Timeline
Underground forum post announces sale of the claimed 20.5M-record SENA database.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
