Dados da Intendencia de Canelones · Breach

[Single source] MortemTeam claims second Canelones government data leak

Nov 11, 2026 · 1 min read

MortemTeam claims it released the second part of a leak from Uruguay's Canelones departmental government. The alleged data includes names, addresses, and phone numbers. The cited count ranges from over 80,000 to 700,000 records and remains unconfirmed.

By HIFY Radar newsroom Updated 11/11/2026 02:59 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Alleged

MortemTeam claims it released a second batch of data connected to the Canelones departmental government in Uruguay. The claim is unverified, the reported volume ranges from more than 80,000 to 700,000 records, and there is no evidence here confirming that government systems were breached.

What happened

Alleged

DailyDarkWeb reported that a threat actor posting for MortemTeam described the release as “Part II” of a campaign targeting Uruguay's government. The purported material contains business and individual entries with names, addresses and phone numbers.

Why it matters

Inferred

If the information is authentic and current, combining names with addresses and phone numbers could make phishing, impersonation and fraud attempts more convincing, even without complete national identification numbers or birth dates.

What to do

Inferred

People and organizations connected to Canelones should treat unexpected messages that use personal details with caution, verify requests through a separate official channel and avoid sharing credentials or payment information. These are precautions based on the reported exposure, not proof that any particular person appears in the files.

Confirmed and still uncertain

Alleged

The available report does not establish where the data came from, whether it is authentic, whether it was recently obtained or whether Canelones government systems were accessed. DailyDarkWeb also said it found no public statement from the Intendencia de Canelones.

What people are saying

Inferred

DailyDarkWeb explicitly characterized the episode as an unverified threat actor claim rather than confirmation of a breach. Its analyst note suggested the material may be directory-style contact data that was aggregated or scraped, citing inconsistent totals, reused target details and mostly empty identity fields.

Evolution

Alleged

The actor reportedly framed this publication as the second installment following earlier warnings against Uruguay's government. The same report says MortemTeam also promoted claims involving an Argentine municipality and had previously named Argentina's central bank and Peru's tax authority, with the latter reportedly denying an intrusion.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

According to DailyDarkWeb, the entries were shared in JSON format and included paternal and maternal surnames, street addresses and phone numbers. Fields for national identification numbers and dates of birth were present but largely empty in the sample it described.

Sources and evidence

Observed

The supplied evidence consists of one DailyDarkWeb post on X and its attached image. It includes descriptions of a posted sample and the actor's statements, but no primary dataset, forensic findings, independent validation or official response from Canelones.