A threat actor has allegedly put a massive database for sale on a cybercrime forum, claiming it belongs to Mexico’s Institute of the National Housing Fund for Workers (Infonavit). Infonavit is a federal government institution in Mexico and is the country’s largest mortgage lender, providing housing loans to workers. The seller claims the database is complete, updated, and contains over 86 million records belonging to Mexican citizens.
To prove their claims, the threat actor shared screenshots showing a list of files apparently organized by Mexican states, with dates from late June and early July 2025, suggesting the data is recent. Another screenshot displayed a sample of the compromised data structure. The dataset allegedly includes a vast amount of sensitive personal information.
The leaked data allegedly consists of:
- Full Name
- Social Security Number ()
- Phone number
- Address
- Unique Population Registry Code ()
- Federal Taxpayers Registry ()
