Skip to content
Support
Sign In Subscribe
Data Breaches

Alleged Breach of Tanzania's BRELA Government Database Exposes 10.2 Million Records Including 8 Million Individuals

,   and  Dark Web Informer
10 min read
Dark Web Informer - Cyber Threat Intelligence

Alleged Breach of Tanzania's BRELA Government Database Exposes 10.2 Million Records Including 8 Million Individuals

March 18, 2026 - 1:38:37 PM UTC
Tanzania
Government
Standalone API Access Now Available High-volume threat-intelligence data, automated ingestion endpoints, ransomware feeds, IOC data, and more.
View API
Unlock Exclusive Cyber Threat Intelligence
Powered by DarkWebInformer.com
Stay ahead of cyber threats with real-time breach tracking, expert analysis, and high quality evidence - built for security professionals, researchers, journalists, and everyday people who take their privacy seriously.
Subscribe Now

Quick Facts

Date & Time 2026-03-18 13:38:37 UTC
Threat Actor Spirigatito
Victim BRELA (Tanzania)
Industry Government
Category Data Breach
Alleged Records 10.2 Million
Individuals Affected ~8 Million
Databases 6
Price Credits (Crypto)
Breach Date February 4, 2026
Network Open Web
Country Tanzania

Incident Overview

A threat actor going by Spirigatito claims to have compromised Tanzanian government infrastructure linked to BRELA (The Business Registrations and Licensing Agency), allegedly retrieving 10.2 million records that include data on approximately 8 million individuals. The actor states the breach occurred on February 4, 2026, and that after the Tanzanian government chose to ignore them, they decided to make the data available for purchase through a dedicated marketplace.


Rather than selling the data as a single dump, the actor has built a custom storefront that organizes the stolen records across 6 curated databases, each priced in credits that can be recharged via cryptocurrency (BTC, ETH, USDT, XMR, and 50+ other cryptocurrencies through OxaPay). The databases and their record counts are:

  • Business Names (Registry): 369K records containing registered business names, sole proprietors, and trade names with full applicant info, location, owner details, and activities. Priced at 2 credits.
  • Companies (Corporate): 279K records of limited companies with full incorporation data, directors, share capital, registered address, and filing history. Priced at 5 credits.
  • Corporate Shareholders (Equity): 7K records of shareholder records, equity positions, beneficial ownership, and stake changes. Priced at 8 credits.
  • People (Contacts): 2.2 million records of individual profiles with verified contact information, demographics, and location data. Priced at 3 credits.
  • TRA TINs (Tax): 7.4 million Tax Identification Numbers from the Tanzania Revenue Authority registry. Priced at 4 credits.
  • Wabunge (Government): 407 records of Members of Parliament with constituency data, party affiliations, and contact records. Priced at 6 credits.

The marketplace offers data in CSV or JSON format with automatic downloads, preview data and field descriptions for each database, and promotes itself as offering leads from Tanzanians for low cost. The actor also notes that the entire database is still available for bulk purchase. This represents a significant government data breach affecting a substantial portion of Tanzania's formally registered population, business ecosystem, and tax records.

Compromised Data Categories

Business Registration Records Corporate Incorporation Data Director & Officer Details Shareholder & Equity Records Individual Contact Information Demographics & Location Data Tax Identification Numbers (TINs) Parliamentary Records Party Affiliations Business Owner Details

Image Preview

Forum post by Spirigatito showing BRELA marketplace with 6 databases totaling 10.2 million records from Tanzanian government infrastructure BRELA marketplace showing credit recharge system, purchasing workflow, and cryptocurrency payment options for stolen Tanzanian government data

Claim URL

Subscriber Access Required The original listing URL and unredacted claim images are available on the Threat Feed and Ransomware Feed for paid subscribers.
Subscribe
Subscriber Access View the original listing URL and unredacted claim images on the feeds below.
Threat Feed (Plus) Threat Feed (Pro/Elite) Ransomware Feed

MITRE ATT&CK Mapping

T1190 Exploit Public-Facing Application
Targets vulnerabilities in government web applications and infrastructure to gain unauthorized access to backend databases and registries.
T1213 Data from Information Repositories
Extracts structured records from government registries including business registrations, corporate filings, tax records, and parliamentary data across 6 separate databases.
T1005 Data from Local System
Collects data directly from compromised government systems, extracting full database tables with millions of records including personal and corporate information.
T1560 Archive Collected Data
Organizes and packages stolen data into structured CSV and JSON formats across 6 categorized databases for distribution through a custom marketplace.
T1567 Exfiltration Over Web Service
Distributes stolen government data through a purpose-built web marketplace with automated downloads, credit-based purchasing, and cryptocurrency payment processing.
T1589.002 Gather Victim Identity: Email Addresses
Harvests personal contact information, demographics, and identification details for 8 million individuals from government registries for resale as leads.

Dark Web Informer © 2026 | Cyber Threat Intelligence
DarkWebInformer.com

Related

Latest