Incident Overview

A threat actor operating under the alias CryptoDead has allegedly leaked approximately 100GB of data from ICFES (Instituto Colombiano para la Evaluación de la Educación), Colombia's national education testing institute responsible for administering standardized exams like the Saber tests to millions of students across the country.

The actor framed the leak as a politically motivated act of protest, citing frustration with Colombia's healthcare system and calling on Colombian citizens to demand accountability from their government. The post claims the dataset contains personal information on more than 30 million Colombians. Key details from the listing include:

• Data Volume - Approximately 100GB of compressed data distributed as a .tar.zst archive, requiring the zstd decompression tool to extract.
• Alleged Scope - The actor claims the leak covers more than 30 million Colombian citizens, which would represent a significant portion of the country's population.
• Motivation - The leak was explicitly framed as hacktivism, with the actor stating dissatisfaction with the Colombian healthcare system and government leadership as the driving reason.
• Distribution - The data was posted freely with a direct download link, not offered for sale, making it immediately accessible to anyone.

ICFES manages education evaluation data for the entire Colombian population that participates in standardized testing, meaning the database likely contains sensitive personal identification details, academic records, and potentially contact information spanning years of test administration. If verified, this would be one of the largest data exposures affecting Colombian citizens.