A threat actor claims to have breached the internal networks of several Uruguayan government organizations, gaining access to numerous databases containing the personal information of millions of citizens. The actor states they have compiled this data into a private, queryable service offered through Telegram.
The state organizations involved in the alleged breach include:
- Sistema Único de Cobro de Ingresos Vehiculares (SUCIVE): The national system for vehicle-related payments and fines.
- Administración Nacional de Educación Pública (ANEP): The national public education administration.
- Intendencia de Montevideo (IMV): The municipal government of Montevideo.
- Dirección Nacional de Identificación Civil (DNIC): The national civil identification directorate.
- Plan Ceibal: A national project providing laptops to students and teachers.
According to the actor, the compromised data is extensive and includes highly sensitive personal information. The allegedly exfiltrated data includes:
- Full names
- National identification numbers (Cédula de Identidad)
- Dates of birth
- Physical addresses
- Telephone numbers (and associated owners)
- Detailed family member information
- Complete educational records
- Vehicle registration details and fine history
- Geolocation data for government-issued devices
