🚨 CYBERINTEL ALERT: MASSIVE LEAK OF STATE, EDUCATIONAL, AND MEDIA INFRASTRUCTURE – ARGENTINA 🇦🇷🏛️📂🔓 [STATUS: UNDER INVESTIGATION]
One of the most critical postings regarding the digital infrastructure of the Argentine Republic has been detected. Threat actor Skull1172, representing the group EsqueleSquad TEAM, has announced the massive leakage of data originating from multiple government (.gob.ar), educational (.edu.ar), and media (Crónica: https://t.co/TOAleGVzGf) domains.
The attacker claims that these compromises were carried out between 2024 and 2026, culminating in a consolidated database of over 80 million records, and threatens to release an archive exceeding 50 GB if the post receives sufficient support on the forum.
🏢 Affected Sectors: Federal and Provincial Government, Public University System, Media Outlets (Argentina).
👤 Threat Actor: EsqueleSquad TEAM (User: Skull1172).
📊 Total Exfiltrated Volume:
80,000,000 lines of credentials (Phone numbers, DNI/CUIL, email addresses, passwords, and vehicle license plates).
154,654 compromised webmail conversations.
📅 Report Date: May 6, 2026.
⚠️ Status: SAMPLE AVAILABLE / THREAT OF +50GB LEAK.
📊 Compromised Infrastructure and Domains
1. Government Entities and Citizen Services (.gob.ar)
The actor lists over 900 affected pages. Among the most critical access points are:
AFIP (https://t.co/dTbL2scGGj): 11.8 million claimed records.
ANSES (https://t.co/VAJRFJCvhD and APIs). Identity and Management: Mi Argentina (https://t.co/lA5nKhlXZA, https://t.co/L6EdQl9j0m), GDE – Electronic Document Management (https://t.co/nMn3YZHYAw, https://t.co/nMcNiDGzU7).
Transport and Education: SUBE (https://t.co/wMecehHzLd, https://t.co/scQHqIwP5B), Progresar Scholarships (https://t.co/rvpFJmWR7p, with 650k records), and Road Safety.
Provincial/CABA Portals: https://t.co/bJjITEG1nr, https://t.co/gATsx5gBAV, AGIP (https://t.co/nczfFa6ern), Chaco (https://t.co/F9ccmybKhs).
2. University Sector (.edu.ar)
Systemic compromise of academic self-service portals at universities such as:
UNER, UNTREF, UNVM, UNTDF, UCU, USAL, UNO, UNPILAR, UPC, UPATECO, UNAM, UGD, and UNLAM.
3. Media Sector: Crónica (https://t.co/TOAleGVzGf)
The group claims to have breached the news channel's administration panels, metrics, and FTP servers. Of extreme gravity is the actor's claim to possess confidential information ("sensitive panels") that allegedly exposes the receipt of government funds, thereby exposing data regarding the media outlet's employees.
🛡️ Immediate Response Recommendations
🔒 API Blocking and Rate Limiting: The National Cybersecurity Directorate and the affected ministries must implement strict Rate Limiting and authentication audits (Tokens/OAuth) on exposed ANSES and RENAPER endpoints to halt the ongoing scraping activity.
🔑 Mass Credential Reset: It is imperative to force password changes (for *Clave Fiscal* and *Mi Argentina* accounts) and mandate the use of Multi-Factor Authentication (MFA) for all government employees (within the GDE system) and citizens.
Monitor: https://t.co/wk9bZJ3laQ
#CyberSecurity #Argentina #DataBreach #AFIP #ANSES #RENAPER #Cronica #EsqueleSquad #OSINT #CyberAlert #VECERT 🇦🇷🛡️⚠️🚨🏛️
🚨 CRITICAL ALERT: Possible Massive Database Leak at ANSES Argentina 🇦🇷🔓
Analyzer has detected a database of massive proportions belonging to Argentina's National Social Security Administration (ANSES) being offered for sale. Threat actor "undertaker" has published records that compromise the financial and personal privacy of millions of citizens.
🏛️ Affected Entity: ANSES (https://t.co/X773tosTxX).
🎭 Threat Actor: undertaker.
👥 Data Volume: 24,530,340 total lines.
📧 Unique Emails: 5,564,966.
🆔 Unique CUILs: 10,333,889 (linked to salary and social security records).
🔹 +24 million records and 10.3M unique CUILs.
🔹 Names, addresses, phone numbers, and emails.
🔹 DETAILED SALARIES, year-end bonuses, and employment data.
🛠️ Compromised Information (PII and Salary Data)
The leaked database is extremely detailed, including fields such as:
👤 Identity: First and last names, gender, date of birth, and CUIL/CUIT.
🏠 Location: Street name, street number, floor, apartment number, locality, province, and postal code.
📞 Contact: Phone number and email address.
💸 Critical Financial Data: Total remuneration, taxable remuneration, base salary, year-end bonus (aguinaldo), vacation pay, and performance bonuses.
💼 Employment Context: Company legal name, employment category, and adjustment codes.
Monitor: https://t.co/wk9bZJ2Nli
#Cybersecurity #ANSES #ArgentinaHacked #DataBreach #CUIL #InfoSec #CyberAlert #Urgent
Rechazaron un amparo de los encargados de Registros del Automotor que buscaban restablecer el aumento de sus emolumentos. Resolución del juez federal de La Plata Alberto Recondo 👇🏻
https://t.co/UO3EcBaeOo
Gran servicio de la provincia de La Pampa para obtener partidas del Registro Provincial de las personas. Imprimis la tasa desde la web, la pagas con débito, crédito, o pago online. Mandas un mail con los datos de la partida, adjuntando el pago. Te la mandan al toque 📝
🔐 New #cybercrime intelligence.
🇦🇷 #Argentina: Threat actor who stole 5.7 M driving licenses has launched a Bot to retrieve them individually. First query is free, then it asks for payment.
🚨RENAPER: A pesar de la negación oficial hay confirmación que está libre (sin pago) en la "dark web" una base de datos que incluye de los argentinos, vivos y fallecidos:
-DNI, Nombres, Apellidos, Fecha Nacimiento
-Email
-Domicilios
-Estado Civil
-Viajes en pandemia
-Trámites varios
Hay más info sensible que no es de todos los argentinos sino de algunos subconjuntos y otra información que se puede cruzar o derivar. 🤬
🔐 New #cybercrime intelligence.
🇦🇷 #Argentina: Threat actor selling 5.7M (1.2 TB) driving licences extracted from the DNRPA (Dirección Nacional de Registro de Propiedad del Automotor). Shared sample includes licenses belonging to the President, Ministers and celebrities.
Querés trabajar un domingo calculando intereses para una audiencia que tenes en la semana? Pues no vas a poder, el sitio de la SCJBA no anda. #gestiondigital
ACTUALIZACIÓN DE LA FIRMA DIGITAL EN EL COLEGIO DE ABOGADOS PARA PODER SUBIR PRESENTACIONES ELECTRÓNICAS EN PODER JUDICIAL PCIA BS AS:
Te hacen ir presencial, nada de que te actualicen el certificado de forma remota
💀
🚨CAMBIEN YA SU CONTRASEÑA DE AFIP😤 //@AFIPcomunica
Se filtró una base con datos robados, presumiblemente reunidos de usuarios finales. Si fueran de AFIP directamente, la BD sería mucho más grande.
Here is the panel for creating your own fake ID in minutes. Enter whatever data you want, or use some of the randomise buttons. Upload a photo or use one the system has. Hit generate. https://t.co/hCjHWbKJPf
Colegas, cuando tengan casos de #estafasvirtuales contra Bancos, no se olviden de pedir oficio al @BancoCentral_AR para que informe las medidas de seguridad del Banco demandado…
Todos están flojos de papeles 👇👇👇
❌❌ Continúan los errores en la web de AFIP ahora en Simplificación Registral / Datos Complementarios, cuando intentas ingresar un CUIL sale ERROR: Contacte al administrador del sistema e informe el código de error: O37724... ❌❌