Actor Claims DIAN Data Breach Exposed 18 Million Colombian Records
Summary
A seller claims an unpatched vulnerability in DIAN’s Cielingenieria-developed appointment platform enabled access to a 16GB SQLite database containing 18 million Colombian records, offered for $2,000. The claim is unverified.
Key points
- The article reports an alleged compromise of Colombia’s tax authority, DIAN, through an unpatched vulnerability in its appointment platform, developed by Cielingenieria.
- The actor claims to have extracted a 16GB SQLite database containing 18 million Colombian records.
- The database is reportedly offered for sale on a hacker forum for $2,000.
- The seller also claims to offer custom software to exploit the vulnerability and extract additional documents, including information about foreign citizens and companies.
- The article says the database structure suggests sensitive personal and corporate records, but provides no independent confirmation of the breach or the claims.
Article Details
- Victim Organization
- Dirección de Impuestos y Aduanas Nacionales (DIAN)
- Incident Type
- Reported data breach involving unauthorized access through an unpatched vulnerability in DIAN's appointment platform.
- Data Types Exposed
- Personal information of Colombian citizens
- Information about foreign citizens and companies was reportedly accessible for further extraction
- Affected Records
- The actor claims the database contains 18 million records.
- Affected Data Size
- The actor claims the database is 16GB and in SQLite format.
- Operational Impact
- Unauthorized access and alleged extraction of a database. The vulnerability was reportedly still active, and the seller claimed custom software could extract additional documents.
- Ransom Or Extortion
- The actor reportedly offered the database for sale for $2,000 USD. No ransom demand is reported.
- Claim Status
- claimed