> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Taxpayer Database From Mexico's Coahuila State Government Allegedly Leaked
- URL: https://darkwebinformer.com/taxpayer-database-from-mexicos-coahuila-state-government-allegedly-leaked/
- Published: 2026-06-25T15:50:26.000Z
- Updated: 2026-06-25T16:14:48.000Z
- Author: Dark Web Informer
- Tags: Leaks

Breach Report ![Mexico flag](https://flagcdn.com/w40/mx.png)Mexico Government 

## Taxpayer Database From Mexico's Coahuila State Government Allegedly Leaked

Threat actors using the aliases **M1sery157** and **D3spair157** (operating as “Sociedad privada 157”) have posted what they describe as a database scraped from a **Coahuila state government portal** in Mexico. The actors claim they exploited long-standing web vulnerabilities in the portal to extract taxpayer (*contribuyente*) records, and that the leak contains **1,396 records** in CSV format. Per the post, each record includes the taxpayer's name, **RFC (Mexican federal tax ID)**, full home address (street, cross streets, neighborhood, and postal code), phone number, and detailed workplace information including the employer's name, activity, address, and phone. The dataset's authenticity and scope are **unverified**.

Severity MEDIUM 

Data1,396 records

AccessFree leak

Country![Mexico flag](https://flagcdn.com/w40/mx.png)Mexico

ActorM1sery157

### ▣Post details

TargetCoahuila state government portal (Mexico)

Country![Mexico flag](https://flagcdn.com/w40/mx.png)Mexico

SectorGovernment / Public Sector

ClaimTaxpayer database scraped & leaked

DataNames, RFC, home & work addresses, phones

VectorExploited portal web vulnerabilities

ObservedJun 23, 2026

ActorM1sery157 x D3spair157

### !Allegedly included

- 1,396 records (claimed)
- Taxpayer names
- RFC (Mexican tax ID)
- Full home addresses
- Neighborhood & postal code
- Phone numbers
- Workplace name & activity
- Workplace address & phone

### ◱Screenshot

[ ![Coahuila Mexico alleged government data leak Screenshot 1](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/06/2978359728364978623598729876569872365.png) Screenshot 1 Redacted preview ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/06/2978359728364978623598729876569872365.png) 

### ⚠Potential impact

Although the dataset is small, the per-record content is sensitive: it ties named taxpayers to their **RFC** (a Mexican federal tax identifier used across financial and government services), full **home and workplace addresses**, and phone numbers. This combination supports identity theft and tax-related fraud, targeted phishing and impersonation, and, because it pairs names with both home and work locations, physical-targeting risks such as extortion, which are a particular concern in Mexico. The data reportedly originates from a government portal exposed through unpatched web vulnerabilities, pointing to a wider security gap. No taxpayer records, names, RFCs, addresses, or download links are reproduced here. The scope and authenticity are unverified.

### iStatus

Unverified 

Sample field headers, a CSV download, and a Telegram channel were posted to a forum; the sample, download links, and the actors' channel are not reproduced here. The actors claim the data was obtained by scraping a Coahuila government portal via web vulnerabilities. The claim has **not been independently confirmed** and Coahuila authorities have not publicly addressed it.

Want the non-redacted screenshots? **Paid subscribers** get all of the claim details and unredacted screenshots. Check out the [threat feed](https://darkwebinformer.com/threat-feed/) or [ransomware feed](https://darkwebinformer.com/ransomware-feed/) (whichever applies to this post), then after subscribing, search there for this alert to view the unredacted version. [View pricing →](https://darkwebinformer.com/pricing) 

[DARK WEB INFORMER](https://darkwebinformer.com/) \- THREAT INTELLIGENCE