FCT-IRS Full Breach Claim Includes 5M Records and 121K Users
A forum actor posting as Individual is selling what they claim is a full breach of the Federal Capital Territory Internal Revenue Service (FCT-IRS) in Nigeria. The listing advertises 87 database tables, approximately 5 million records, 7 GB of data and 121,000 users. The actor claims the material includes user accounts, email addresses, hashed passwords, OAuth tokens, tax profiles, images, workflows, identity-verification images and signatures. Visible samples also show taxpayer-account fields, tax identification numbers, taxpayer types, payer IDs, compliance status, ledger balances, tax-office information, employee IDs, MFA fields, profile-photo paths and tax-relief or audit-related file metadata. The claim is unverified.
▣Post details
!What the post claims
- 87 database tables
- Approximately 5 million records
- 7 GB of data
- Approximately 121,000 users
- User names and email addresses
- Hashed passwords
- OAuth tokens
- User IDs and status fields
- Tax-office assignments
- Employee IDs
- Dates of birth
- MFA enabled and method fields
- Profile-photo paths
- Identity-verification images
- Signatures
- Tax identification numbers
- Taxpayer types
- Payer IDs
- VAT-group fields
- Compliance status
- Ledger debit and credit balances
- Ledger total balances
- Workflow and tax-profile records
- Audit and tax-relief file metadata
- Administrative-expense and capital-allowance fields
◱Screenshots
☷Mapped techniques
The post does not describe the initial intrusion method. The technique below is inferred from the breadth of structured user, taxpayer, ledger and administrative records shown in the samples.
- Collection T1213 Data from Information Repositories Inferred The alleged material spans structured user accounts, taxpayer profiles, compliance records, ledger balances, workflow data and supporting files, which is consistent with collection from internal government information repositories or business applications.
⚠Potential impact
If authentic, the dataset could expose taxpayers and agency personnel to identity theft, tax fraud, credential abuse, targeted phishing and account takeover attempts. The combination of email addresses, hashed passwords, OAuth tokens, dates of birth, profile images, signatures, tax identification numbers and taxpayer-account information would create a highly sensitive identity profile. Identity-verification images and signatures could be particularly valuable for impersonation or document fraud, while ledger, compliance and tax-relief records could support convincing tax-themed scams or targeted extortion.
iStatus Unverified
The forum listing provides specific claims of 87 tables, 5 million records, 7 GB of data and 121,000 users, along with visible user, taxpayer, ledger and tax-relief samples and a large set of identity images and signatures presented as evidence. However, the post does not identify the initial access method or independently demonstrate that the advertised material represents the complete FCT-IRS environment. Dark Web Informer has not independently verified the breach, the record counts, the OAuth-token exposure, the identity-verification material or the completeness and authenticity of the alleged database.
Dark Web Informer // Threat Intelligence
