🇵🇪 🚨 PERU: HOSPITAL NACIONAL CAYETANO HEREDIA PATIENT DATA ALLEGEDLY LEAKED, 14.8M RECORDS CLAIMED A threat actor has published a database they claim was stolen from Hospital Nacional Cayetano Heredia (HNCH), a major public hospital in Lima, saying it holds 14.8 million records tied to about 2.5 million people. The actor claims the data includes: * National ID (DNI) numbers * Names, dates of birth and addresses * Phone numbers and email addresses * Medical record numbers and triage details * Chief complaints and diagnosis codes * Insurance affiliation numbers ⚠️ Analyst Note: If genuine, this is one of the most sensitive health data exposures in Peru this year, pairing national IDs with clinical details. Patients should watch for medical fraud, identity theft and scam calls or messages that quote their hospital visits. The data has not been verified, may include older records, and the hospital has not publicly confirmed an incident. This is an unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #DataBreach #Peru #Healthcare #PHI #ThreatIntelligence #CyberSecurity

🇮🇱 🚨 ISRAEL: THREAT ACTOR CLAIMS TO SELL 4.5TB OF MINISTRY OF DEFENSE, MOSSAD AND IDF DATA A threat actor using the name "UNC6783" claims to be selling about 4.5TB of data it says comes from Israeli defense and intelligence bodies. The only sale terms given are "Price? Negotiate with me!" The claimed breakdown: * Israel Ministry of Defense: 2.5TB (claimed) * Mossad: 1TB (claimed) * Israel Defense Forces (IDF): 1TB (claimed) The only proof shared is a screenshot of directory listings. No sample files, record counts or forum listing were provided. Earlier this month, an actor linked to the same alias advertised a "4.5TB" Israeli military cache on an underground forum under different labels (Israel Aerospace Industries, Rafael and the IDF), and separately claimed a ~5TB Israeli Ministry of Defense dataset. Forum users questioned the samples in that earlier listing. The claim has not been independently verified, and we found no official confirmation of any breach. ⚠️ Analyst Note: Anyone can use the UNC6783 name, and nothing here ties this post to the group Google Threat Intelligence tracks under that designation. Sale claims about Israeli defense and intelligence agencies are often exaggerated or recycled, and this one reuses the same 4.5TB figure as the earlier listing with new labels, which points to repackaging rather than a fresh intrusion. Directory listings alone are not proof of access or of what the files contain. We assess this as an unverified threat-actor claim, NOT confirmation of a breach of the Israeli Ministry of Defense, Mossad or the IDF. If any of it is authentic, it could feed influence operations, targeting of personnel and defense-themed phishing. #DDW #DarkWeb #Israel #Mossad #IDF #UNC6783 #ThreatIntelligence #CyberSecurity

🇦🇷 🚨 ARGENTINA: MINISTRY OF EDUCATION SINIDE PLATFORM DATA ALLEGEDLY LEAKED, ~172K STUDENTS A threat actor on a dark web forum has published samples of a database it says comes from SINIDE, the national digital education information system run by Argentina's Ministry of Education. The actor claims: * Records of about 172,000 students, with 80+ fields each * Names, national ID (DNI) numbers and residential details * School, academic performance and socioeconomic data * Data on about 1,100 schools and 953 school principals * Credentials for 21 consultant accounts * The data was reachable without authentication ⚠️ Analyst Note: Most of the affected people are likely minors, which makes this exposure especially serious. National IDs plus home and school details can feed identity fraud and targeted scams against families. The exposed staff credentials should be rotated now. This comes hours after a separate claim against the ministry's Moodle platform. The ministry had not commented at the time of writing. This is an unverified threat-actor claim, NOT confirmation that the ministry was breached. #DDW #DarkWeb #Argentina #DataLeak #Education #ThreatIntelligence

🇦🇷 🚨 ARGENTINA: TELECOM ARGENTINA'S "PERSONAL" CUSTOMER DATA ALLEGEDLY LEAKED A threat actor on an underground forum has published a database of about 129,000 records they claim belongs to customers of Personal, the mobile brand of Telecom Argentina. The actor claims the data includes: * National ID numbers (DNI) and full names * Mobile and landline numbers, service plans * IP addresses, Wi-Fi network names and User-Agent strings * User IDs and server logs The actor says the data came from a compromised company web service and describes it as recent, covering active customers. The claim has not been independently verified. ⚠️ Analyst Note: If authentic, DNI numbers tied to active mobile lines are a ready kit for SIM-swap fraud, account takeover and targeted phishing. Customers should be wary of calls or texts impersonating Personal or their bank. Unverified threat-actor claim, NOT confirmation that Telecom Argentina systems were breached. #DDW #DarkWeb #Argentina #TelecomArgentina #Telecom #DataBreach #ThreatIntelligence