> ## Content Index > Fetch the complete content index at: https://darkwebinformer.com/llms.txt > Use this file to discover other available public pages before exploring further. # Alleged Data Leak Exposes 30 Million Colombian Citizens From ICFES National Education Database - URL: https://darkwebinformer.com/alleged-data-leak-exposes-30-million-colombian-citizens-from-icfes-national-education-database/ - Published: 2026-03-13T14:58:50.000Z - Updated: 2026-03-13T16:22:14.000Z - Author: Dark Web Informer - Tags: Leaks Dark Web Informer - Cyber Threat Intelligence # Alleged Data Leak Exposes 30 Million Colombian Citizens From ICFES National Education Database March 13, 2026 - 3:48:06 AM UTC Colombia Education / Government Standalone API Access Now Available High-volume threat-intelligence data, automated ingestion endpoints, ransomware feeds, IOC data, and more. [ View API](https://darkwebinformer.com/api-details/) Unlock Exclusive Cyber Threat Intelligence Powered by DarkWebInformer.com Stay ahead of cyber threats with real-time breach tracking, expert analysis, and high quality evidence - built for security professionals, researchers, journalists, and everyday people who take their privacy seriously. [ Subscribe Now](https://darkwebinformer.com/pricing) ## Quick Facts Date & Time 2026-03-13 03:48:06 UTC Threat Actor CryptoDead Victim ICFES (Colombia) Industry Education / Government Category Data Leak Alleged Records 30+ Million Data Size \~100 GB Motivation Hacktivism / Political Network Open Web Price Free (Public Leak) ## Incident Overview A threat actor operating under the alias CryptoDead has allegedly leaked approximately 100GB of data from ICFES (Instituto Colombiano para la Evaluación de la Educación), Colombia's national education testing institute responsible for administering standardized exams like the Saber tests to millions of students across the country. The actor framed the leak as a politically motivated act of protest, citing frustration with Colombia's healthcare system and calling on Colombian citizens to demand accountability from their government. The post claims the dataset contains personal information on more than 30 million Colombians. Key details from the listing include: - **Data Volume** \- Approximately 100GB of compressed data distributed as a .tar.zst archive, requiring the zstd decompression tool to extract. - **Alleged Scope** \- The actor claims the leak covers more than 30 million Colombian citizens, which would represent a significant portion of the country's population. - **Motivation** \- The leak was explicitly framed as hacktivism, with the actor stating dissatisfaction with the Colombian healthcare system and government leadership as the driving reason. - **Distribution** \- The data was posted freely with a direct download link, not offered for sale, making it immediately accessible to anyone. ICFES manages education evaluation data for the entire Colombian population that participates in standardized testing, meaning the database likely contains sensitive personal identification details, academic records, and potentially contact information spanning years of test administration. If verified, this would be one of the largest data exposures affecting Colombian citizens. ## Compromised Data Categories Personal Identification Information Education & Academic Records Test Scores & Exam Data Contact Information Demographic Data ## Image Preview [![Forum post by CryptoDead announcing ICFES data leak of 30 million Colombian citizens with political motivation statement](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/03/12768717670418058218.png)](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/03/12768717670418058218.png) [![Sample data from ICFES leak showing database records with personal information fields](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/03/12768717670418058219.png)](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/03/12768717670418058219.png) ## Claim URL Subscriber Access Required The original listing URL and unredacted claim images are available on the Threat Feed and Ransomware Feed for paid subscribers. [ Subscribe](https://darkwebinformer.com/pricing) ## MITRE ATT&CK Mapping [ T1530 Data from Cloud Storage Accesses data stored in cloud services or online databases, extracting large volumes of records from centralized storage systems. ](https://attack.mitre.org/techniques/T1530/) [ T1005 Data from Local System Collects files and data directly from compromised systems, including database exports and document archives. ](https://attack.mitre.org/techniques/T1005/) [ T1560 Archive Collected Data Compresses stolen data into archives before distribution. In this case, a .tar.zst compressed archive was used to package approximately 100GB of data. ](https://attack.mitre.org/techniques/T1560/) [ T1048 Exfiltration Over Alternative Protocol Transfers stolen data out of the target environment using channels other than the primary command-and-control connection. ](https://attack.mitre.org/techniques/T1048/) [ T1567 Exfiltration Over Web Service Uses legitimate web services and file hosting platforms to distribute stolen data publicly, making takedown more difficult. ](https://attack.mitre.org/techniques/T1567/) [ T1078 Valid Accounts Uses compromised or stolen credentials to gain unauthorized access to systems and databases containing sensitive information. ](https://attack.mitre.org/techniques/T1078/) Dark Web Informer © 2026 | Cyber Threat Intelligence [DarkWebInformer.com](https://darkwebinformer.com/)