RENIEC · Breach

[Single source] Claim: Actor claims sale of 31 million records from Peru's RENIEC registry

Nov 10, 2026 · 1 min read

A threat actor on a dark web forum claims to sell about 31 million records from RENIEC, Peru's national identity and civil registry, roughly the size of the country's adult population. The listing shows no sample, field list, price or proof of access, and the content is hidden. The claim remains unverified.

By HIFY Radar newsroom Updated 11/10/2026 01:04 AM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In 30 seconds

Observed

A threat actor on a dark web forum claims to be selling about 31 million records pulled from RENIEC, Peru's national identity and civil registry, a figure roughly the size of the country's entire adult population. The listing, titled "Peru RENIEC National Citizen Database 31M 2026", offers no sample data, no field list, no price and no proof that the seller actually holds anything. The contents are hidden behind a forum reply wall. Nothing here is verified, and nothing here confirms a breach at RENIEC.

What happened

Observed

The claim reached a wider audience on November 10, 2026, when DailyDarkWeb, an account that monitors underground forums, reported the listing on X. According to that report, an actor on a dark web forum posted a sales thread claiming to hold roughly 31 million records from RENIEC, the agency that issues the DNI, the national ID card every adult Peruvian carries.

Observed

What the visible part of the post actually shows is thin. A claimed record count of 31 million, a title that stamps the dataset as a 2026 product, and nothing else of substance. There is no sample of the data, no list of what fields it contains, no asking price and no demonstration of access. The bulk of the content sits hidden until forum users reply to the thread.

Why it matters

Alleged

The reason researchers watch RENIEC claims closely is what national ID data enables. The analyst note in the report warns that if this data is genuine, DNI records at this scale would fuel identity fraud and KYC bypass, meaning criminals could defeat the know-your-customer checks that Peruvian banks and telecoms use to verify who someone is. That is a conditional risk assessment, not a statement that harm has occurred.

What to do

Inferred

Until the claim is checked, the sensible posture is calm skepticism. Treat this as an unconfirmed sales pitch, not a confirmed leak. Peruvians do not need to act on it today, but staying alert to phishing that leverages personal details is always reasonable, and organizations that rely on DNI data for identity checks have reason to monitor how this develops.

Confirmed and still uncertain

Observed

What is known so far: a forum listing exists, it claims about 31 million RENIEC records, it hides its content behind a reply wall, and it shows no sample, fields, price or proof of access. A researcher account publicized it on November 10, 2026.

Inferred

What is not known is everything that matters: whether the data exists, whether it actually came from RENIEC, how recent it is, and whether it is simply older material dressed up as new. The reporting account itself notes that RENIEC-labelled datasets have circulated on underground forums before, so recycling is a live possibility. As of the post, RENIEC had said nothing.

What people are saying

Alleged

DailyDarkWeb, the only public voice on this so far, is explicit about the limits: it calls the post an unverified threat-actor claim and stresses it is not confirmation of a breach. The account also raises the recycling hypothesis, suggesting the data may be repackaged from earlier RENIEC-labelled leaks that have circulated underground before.

Observed

From the Peruvian government side, the picture is silence. As of the November 10 report, no statement from RENIEC had appeared, so there is no official confirmation, denial or characterization of the listing yet.

Evolution

Inferred

The evidence picture has not moved since the claim surfaced. It began and, so far, remains a single dark web listing behind a reply wall, amplified by one monitoring account. No sample has appeared, no buyer has surfaced, no second researcher has corroborated the data, and no official response has landed. The story is exactly as strong as one unverified post.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Observed

Mechanically, the listing follows a familiar underground sales format. The title packages the alleged dataset as "Peru RENIEC National Citizen Database 31M 2026", branding it with the target, the claimed volume and a freshness year. The payload is gated by a reply wall, a forum convention that hides content until a user replies to the thread, which conveniently doubles as engagement bait and a hurdle for outside verification.

Inferred

Notably absent are the artifacts credible data sellers usually provide: a sample row, a field schema, a price or some demonstration of access. Their absence does not prove the claim false, but it removes every normal checkpoint a buyer or researcher would use to test authenticity, which is itself a signal worth weighing.

Sources and evidence

Observed

This story currently rests on a single evidence item: a November 10, 2026 post by DailyDarkWeb on X, which includes a screenshot of the forum listing. The post is careful reporting, clearly labeling the claim unverified, but it is one source describing one listing, with no independent corroboration, no forum thread exposed publicly and no word from RENIEC. Confidence in any specific fact beyond the listing's existence should stay low until more evidence arrives.