> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Uruguay's Primary Education Databases Allegedly Breached, 1M+ Children's Records Offered for Sale and Query
- URL: https://darkwebinformer.com/uruguays-primary-education-databases-allegedly-breached-1m-childrens-records-offered-for-sale-and-query/
- Published: 2026-08-06T15:52:44.000Z
- Updated: 2026-08-06T15:52:44.000Z
- Author: Dark Web Informer
- Tags: Data Breaches

Breach Report ![Uruguay flag](https://flagcdn.com/w40/uy.png)Uruguay Government / Primary Education Sold as a Service 

## Uruguay's Primary Education Databases Allegedly Breached, 1M+ Children's Records Offered for Sale and Query

An actor posting as **LaPampaLeaks** claims to hold the databases behind **GURI**, the student management platform operated by Uruguay's **CEIP** primary education council, covering pupils enrolled between **2012 and 2025**. The listing describes a family application database of **1,144,324 records** alongside enrolment databases totalling **3.2 million**. Fields named include **national identity numbers, full names, dates of birth, home addresses, phone numbers, email addresses, family identifiers, and the specific school and class each child attended**. Beyond the sale, the actor states the data is **already loaded into a subscription service allowing clients to look up any Uruguayan citizen's school history**. The claim is **unverified**.

Severity CRITICAL 

Family app records1,144,324

Enrolment records3.2M

Range2012–2025

ActorLaPampaLeaks

### ▣Post details

TargetCEIP / GURI platform

Country![Uruguay flag](https://flagcdn.com/w40/uy.png)Uruguay

SectorGovernment / Primary education

ListingHighest bidder, no set price

SubjectsSchoolchildren and families

Also offeredQuery service subscription

ObservedAug 6, 2026

ActorLaPampaLeaks

### !Allegedly included

- National ID numbers
- Full names
- Dates of birth
- Home addresses
- Phone numbers
- Email addresses
- Family ID numbers
- Parent relationship records
- School name & number
- Class and year attended
- Department & jurisdiction
- Gender
- Socio-cultural classification
- Registration dates

### ◱Screenshots

[ ![Uruguay CEIP GURI education database sale listing screenshot, August 2026 (1 of 2)](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/129738569287365982736498712645978198745.png) Screenshot 1 Redacted preview ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/129738569287365982736498712645978198745.png) [ ![Uruguay CEIP GURI education database sale listing screenshot, August 2026 (2 of 2)](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/129738569287365982736498712645978198746.png) Screenshot 2 Redacted preview ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/129738569287365982736498712645978198746.png) 

### ⚠Potential impact

The subjects here are **children**, and the field combination is the concern rather than the volume. A record pairing a named child's **date of birth and home address with the specific school and class they attend** is a location dataset, not a marketing one, and no remediation exists for it: a child cannot change their identity number, their address, or where they went to school. The **family identifiers extend the exposure to parents and siblings**. What distinguishes this listing is that the data is described as **already queryable through a paid service**, which lowers the barrier from acquiring a database to simply searching a name, and the actor markets that capability for confirming a person's identity and reconstructing who they knew.

### iStatus

Unverified 

The post includes record samples and screenshots of what appear to be **authenticated queries against live endpoints**, suggesting access may be ongoing rather than historical. Dark Web Informer is **not reproducing the endpoints, parameters, or contact channels**. The actor alleges CEIP previously characterised this as a limited cybersecurity incident and took its platform offline for a week without disclosing the scope; that account is the actor's own and is uncorroborated. The claim is **unverified** and CEIP has not addressed this listing.

Want everything on this breach? **Paid subscribers** get the full claim details and more. Check out the [threat feed](https://darkwebinformer.com/threat-feed/), then after subscribing, search there for this alert. [View pricing →](https://darkwebinformer.com/pricing) 

[DARK WEB INFORMER](https://darkwebinformer.com/) \- THREAT INTELLIGENCE