Loading story…
NyxarGroup has claimed two separate compromises involving Chilean government-related platforms, including an alleged theft of 250GB of data from Chile’s Ley del Lobby transparency portal and the publication of 110,000 records from the Servicio Civil training platform. The Ley del Lobby listing advertises data spanning 2018 to 2026 for $2,000, with the actor asserting it includes hearing records, institutional data, full names, Chilean RUT numbers, passport details, contact information, represented-party names, and detailed meeting schedules and locations.
The alleged exposure is particularly sensitive because the sample reportedly contains upcoming hearings and meetings involving senior government and military officials, raising concerns about both privacy and operational security. In the separate Servicio Civil incident, the leaked records reportedly contain full names and internal user IDs, effectively creating a directory of Chilean public servants. The actor is said to have released that dataset for free on the open web and indicated plans to publish data from another Chilean website, suggesting a broader campaign targeting Chilean public-sector systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Following the two Chile-related disclosures, NyxarGroup reportedly indicated plans to release data from another Chilean website in the future. This suggested a possible ongoing campaign against Chilean government-linked platforms.
NyxarGroup allegedly published for free a dataset of roughly 110,000 records from Chile's Servicio Civil campus training platform. The exposed information reportedly included full names and internal user IDs of Chilean public servants, creating a directory of government employees.
NyxarGroup claimed it had stolen about 250GB of data from Chile's Ley del Lobby platform and listed the dataset for sale for $2,000. The data was described as spanning 2018 to 2026 and allegedly included lobbying records, identity details, contact information, and meeting schedules involving senior government and military officials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
darkwebinformer.com
Open sourcedarkwebinformer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Armenian authorities opened an investigation after a threat actor using the alias **dk0m** advertised for sale a dataset allegedly containing nearly **8 million** government-related records tied to a state notification system used to distribute official legal and administrative communications. The data was marketed on an underground forum for **$2,500** and was described as including notifications and communications associated with police and judicial bodies; officials in Yerevan publicly denied that the country’s **government email infrastructure** had been breached while acknowledging the possibility that another state platform was accessed. Armenia’s Public Relations and Information Center (PRIC) said a preliminary review indicates the leaked material may have originated from the **electronic civil litigation** platform, and that an internal probe is ongoing to confirm the source and access path. Researchers at **CyberHUB-AM** assessed dk0m as a recurring data broker active since at least 2024 and reported the actor commonly uses **infostealer malware** to harvest credentials/session data and identify access to sensitive government portals before repackaging and reselling datasets; screenshots reportedly dating to **August 2024** were cited as supporting evidence. The alleged exposure could increase **social engineering** risk by enabling highly credible scams referencing real case numbers, fines, or enforcement actions.
Jun 29, 2026
Spain’s **Ministry of Science, Innovation and Universities** partially shut down its “electronic headquarters,” suspending administrative procedures and disrupting citizen- and company-facing services after reporting a “technical incident” under assessment. A threat actor using the alias **GordonFreeman** claimed responsibility, posted alleged proof-of-breach samples on underground forums, and offered purportedly stolen data for sale; the samples were described as including personal records, email addresses, enrollment applications, and screenshots of official documents, with the actor alleging exploitation of a critical **IDOR** flaw to obtain valid credentials. Separately, Spain’s **Ministry of Finance (Ministerio de Hacienda y Función Pública)** faced an unverified data-breach claim from a threat actor calling themselves **HaciendaSec**, who advertised alleged access to data on **~47.3 million** citizens (including claimed tax identifiers and banking details) on a dark web forum. The Ministry, working with Spain’s **National Cryptologic Centre (CCN)**, stated it found **no evidence** of compromise or exfiltration in internal systems as of the initial investigation, and authorities are assessing whether the dataset is authentic, recycled, or sourced elsewhere; this incident is distinct from an unrelated outage at Rome’s **La Sapienza** university following a suspected ransomware attack.
Jun 29, 2026
Dark web monitoring reports described **unverified data leak claims** involving several organizations, including French parcel delivery firm **Colis Privé**. One post on **BreachForums** allegedly offered an upload of **22,564,381 records** attributed to Colis Privé, described as `.jsonl` files totaling **~4.1 GB**; no specific threat actor attribution or company confirmation was cited, and the notice characterized the situation as informational while scope is assessed. If authentic, the scale and format of the dataset would materially increase risk of **identity theft, credential stuffing, and targeted phishing** against customers. Separate dark web forum posts also alleged database exposures affecting **JobsGO** (Vietnam recruitment platform), **MyVete** (veterinary management platform), **PIXPAY** (Senegalese payment service), and **Groupe Fondasol** (France-based engineering). The claimed datasets reportedly include **CV/personal records**, and in some cases **API credentials and employee metadata**, with example figures including **~2.3 million records** for JobsGO and **~5.57 million records** for MyVete (verification not indicated). Across the claims, the primary business risk is downstream abuse of exposed personal and operational data for **social engineering, recruitment fraud, and account takeover**, rather than immediate exploitation of a specific software vulnerability.
Jun 29, 2026