A threat actor claims to have breached the Public Authority for Civil Information (PACI) of Kuwait, the government body responsible for citizen identity, population statistics, and mapping data. The actor states the breach compromised all primary systems of the agency, including the Kuwaiti Population Statistics System, Identity Issuance System, Deceased Records System, Kuwaiti Mapping System, and the Kuwait Mobile ID application. The actor frames the operation as a direct response to alleged aggression against Iraqi fishermen in Iraqi territorial waters and warns of further attacks against any state seen as overstepping against Iraqi sovereignty. The actor also claims to have already executed destructive actions, including the deletion of maps belonging to the Kuwaiti Ministry of Health, and is selling the data to a maximum of 12 buyers for $1,000 USD.

• Civil IDs: full identification records for all Kuwaiti citizens
• Traffic Maps: comprehensive traffic and infrastructure mapping
• Military Maps: sensitive military geographic data of Kuwait
• Residential Data: house locations, owner names, and contact numbers
• Statistics Bureau Data: full demographic data on all Kuwaiti citizens and families
• Death Records: data on deceased Kuwaitis from 1980 until May 12, 2026
• ID Photos: images of all Kuwaiti IDs (5.23 million records)
• Kuwaiti Population Statistics System (full system compromise)
• Identity Issuance System (full system compromise)
• Deceased Records System (full system compromise)
• Kuwaiti Mapping System (full system compromise)
• Kuwait Mobile ID application (full system compromise)
• Ministry of Health mapping data (reportedly deleted by the actor as a destructive action)