Instituto Nacional de Salud da Colômbia SIVIGILA · Breach

Claim: NyxarGroup offers 5,227,341 SIVIGILA records and sample

Nov 12, 2026 · 1 min read

NyxarGroup claims to be selling 5,227,341 records obtained from SIVIGILA, operated by Colombia's National Institute of Health. The claim remains unverified, but DarkWebInformer reports that the group published a 100,000-record sample and is asking $500 for the complete database. Colombians should watch for fraudulent health-themed messages that use real personal details.

By HIFY Radar newsroom Updated 11/12/2026 08:52 PM Get this every day →← Back to the feed 2 sources

CriticalBreachNo software to update

In 30 seconds

Alleged

The latest report says NyxarGroup is offering 5,227,341 records allegedly obtained from Colombia's SIVIGILA health surveillance system, with a 100,000-record sample and a $500 asking price. The source explicitly says the claim is unverified.

What happened

Observed

Two threat-intelligence accounts reported a dark-web sale attributed to NyxarGroup. Both describe an alleged SIVIGILA dataset and the same sample size and price, but they give sharply different totals: 2,527,341 and 5,227,341 records.

Why it matters

Inferred

If authentic, the material could connect identifiable Colombians with disease-surveillance information, contact details and locations. That combination could enable convincing health-themed scams and expose sensitive medical information.

What to do

Inferred

Colombians should treat unexpected health-related messages with caution, even when they contain accurate personal details. Verify requests through official channels, avoid opening unsolicited links or files, and do not share passwords, verification codes or payments in response.

Confirmed and still uncertain

Observed

The observed facts are limited to the two accounts' reports about the listing, sample and price. The evidence provided does not independently authenticate the sample, establish when or how any data was obtained, identify affected people, or confirm that INS or SIVIGILA suffered a breach.

What people are saying

Observed

DarkWebInformer labels the claim unverified. DailyDarkWeb likewise calls it an unverified threat-actor claim rather than confirmation of a breach, and suggests the unusually low price could indicate partial or recycled data.

Evolution

Contested

The earlier report cited 2,527,341 records and mentioned the actor's claim that roughly 50,000 records had previously been leaked by someone else. A later report raised the advertised total to 5,227,341 without explaining the discrepancy, so the claimed scale remains contested.

Reach

Observed

2 independent groups, 3 updates, and 11 engagements.

Technical detail

Alleged

The alleged dataset includes names, national identification numbers, birth dates, phone numbers, home addresses, disease or health-event codes, demographic and geographic information, and healthcare-provider or reporting details.

Sources and evidence

Observed

The evidence consists of two social-media reports describing a threat-actor listing and accompanying images. No official INS notice, authenticated database extract, forensic report or direct technical evidence is included, while the conflicting record counts weaken confidence in the listing's details.