Actor claims to sell 41.4M Colombian civil registry records
Threat actor GordonFreeman1 claims on an underground forum to be selling 41,415,693 records (about 1.45TB) from Colombia's Registraduría Nacional del Estado Civil, the body that runs national ID and elections. The actor says access came through a vulnerable API, asks $20,000, and also offers a custom lookup API built on the data, which allegedly includes names, ID numbers and birth data. Nothing has been independently verified and the registry has not confirmed the breach.
What happened
An actor using the alias GordonFreeman1 claims on a dark web forum to be selling 41,415,693 records (about 1.45TB) from Colombia's Registraduría Nacional del Estado Civil, the body that runs national ID and elections. The data allegedly includes full names, national ID document numbers, issue dates and status, and dates and places of birth. Nothing has been independently verified and the registry has not confirmed the case.
Why it matters
If genuine, the volume would cover most of Colombia's population, according to DailyDarkWeb's analyst note. ID numbers paired with birth data are a ready kit for identity fraud, account takeover and targeted phishing, and the actor also offers a custom lookup API that makes abuse trivial. Companies with customers or employees in Colombia face higher exposure.
What to do
Track the registry's official position and threat channels for confirmation or data samples. Strengthen identity verification, fraud alerts and anti-phishing training for audiences in Colombia. Treat Colombian identity data as potentially compromised in onboarding controls.
For the technical team
- Affected
- Registraduría Nacional del Estado Civil (registro civil da Colômbia), órgão que administra o documento de identidade e a · Registraduría Nacional del Estado Civil (Colombia's civil registry), which runs national ID and elections. No specific system or version named.
- Exploitation
- Underground forum sale claim reported by DailyDarkWeb. No confirmed exploitation; nothing independently verified.
- Fix
- Not applicable. No fix involved and the registry has not confirmed the case.
- Vector
- According to the actor, access came through a vulnerable API. No technical detail of the flaw was disclosed and the claim is unverified.
- More details
- The actor asks $20,000 and also offers a custom lookup API built on the data. The listing claims records of political leaders and celebrities are included. DailyDarkWeb stresses this is an unverified claim, not confirmation of a breach.
Timeline
Claim of 41.4 million Colombian citizen records for sale surfaced on a dark web forum.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
