Mexico
Government
Taxpayer Database From Mexico's Coahuila State Government Allegedly Leaked
Threat actors using the aliases M1sery157 and D3spair157 (operating as “Sociedad privada 157”) have posted what they describe as a database scraped from a Coahuila state government portal in Mexico. The actors claim they exploited long-standing web vulnerabilities in the portal to extract taxpayer (contribuyente) records, and that the leak contains 1,396 records in CSV format. Per the post, each record includes the taxpayer's name, RFC (Mexican federal tax ID), full home address (street, cross streets, neighborhood, and postal code), phone number, and detailed workplace information including the employer's name, activity, address, and phone. The dataset's authenticity and scope are unverified.
Mexico▣Post details
Mexico!Allegedly included
- 1,396 records (claimed)
- Taxpayer names
- RFC (Mexican tax ID)
- Full home addresses
- Neighborhood & postal code
- Phone numbers
- Workplace name & activity
- Workplace address & phone
◱Screenshot
⚠Potential impact
Although the dataset is small, the per-record content is sensitive: it ties named taxpayers to their RFC (a Mexican federal tax identifier used across financial and government services), full home and workplace addresses, and phone numbers. This combination supports identity theft and tax-related fraud, targeted phishing and impersonation, and, because it pairs names with both home and work locations, physical-targeting risks such as extortion, which are a particular concern in Mexico. The data reportedly originates from a government portal exposed through unpatched web vulnerabilities, pointing to a wider security gap. No taxpayer records, names, RFCs, addresses, or download links are reproduced here. The scope and authenticity are unverified.
iStatus
UnverifiedSample field headers, a CSV download, and a Telegram channel were posted to a forum; the sample, download links, and the actors' channel are not reproduced here. The actors claim the data was obtained by scraping a Coahuila government portal via web vulnerabilities. The claim has not been independently confirmed and Coahuila authorities have not publicly addressed it.
DARK WEB INFORMER - THREAT INTELLIGENCE
