Threat Actor Claims Sale of 20.56M-Record SENA Colombia Citizen Database
A threat actor using the handle koii is advertising on a dark web marketplace a database allegedly tied to Colombia's Servicio Nacional de Aprendizaje (SENA), claiming 20,564,434 unique records covering citizens nationwide. The listing describes an extensive set of fields including full names, document type and number, dates of birth, addresses, phone numbers, email addresses, occupational profiles, academic history, work experience, training/certifications, internships and driver's-license data, offered in JSONL and database formats. Neither the source of the data, the claimed record count, nor current availability has been independently verified. If genuine, exposure of this breadth of identity, contact and employment data could enable identity fraud, targeted phishing, impersonation and employment-related fraud against millions of Colombian citizens.
Detalhes técnicos
The seller's screenshots reportedly show a database schema and sample records containing direct identifiers (names, document numbers, birth dates, addresses, phone numbers, emails), though these were not reproduced in the report. No malware hashes or attacker-controlled IPs were observed in the supplied material. The mapped technique is T1213.006 (Data from Information Repositories: Databases), inferred rather than confirmed, as the method of acquisition and whether unauthorized access to SENA systems occurred remain undisclosed.
Remediação
Organizations and individuals potentially affected should monitor for credential stuffing, phishing and identity-fraud attempts leveraging personal and employment data. SENA and Colombian authorities should investigate the claim's authenticity and, if confirmed, notify affected citizens and reinforce access controls on relevant systems.
Linha do tempo
-
Threat Actor Claims Sale of 20.56M-Record SENA Colombia Citizen Database
ler a análise desta fonte ocultar
A threat actor using the handle koii is advertising on a dark web marketplace a database allegedly tied to Colombia's Servicio Nacional de Aprendizaje (SENA), claiming 20,564,434 unique records covering citizens nationwide. The listing describes an extensive set of fields including full names, document type and number, dates of birth, addresses, phone numbers, email addresses, occupational profiles, academic history, work experience, training/certifications, internships and driver's-license data, offered in JSONL and database formats. Neither the source of the data, the claimed record count, nor current availability has been independently verified. If genuine, exposure of this breadth of identity, contact and employment data could enable identity fraud, targeted phishing, impersonation and employment-related fraud against millions of Colombian citizens.
Technical Details
The seller's screenshots reportedly show a database schema and sample records containing direct identifiers (names, document numbers, birth dates, addresses, phone numbers, emails), though these were not reproduced in the report. No malware hashes or attacker-controlled IPs were observed in the supplied material. The mapped technique is T1213.006 (Data from Information Repositories: Databases), inferred rather than confirmed, as the method of acquisition and whether unauthorized access to SENA systems occurred remain undisclosed.
Remediation
Organizations and individuals potentially affected should monitor for credential stuffing, phishing and identity-fraud attempts leveraging personal and employment data. SENA and Colombian authorities should investigate the claim's authenticity and, if confirmed, notify affected citizens and reinforce access controls on relevant systems.