2026 Hostinger Colombia — DozerMx forum claim; ~4.4M records, 58k+ ID photos, 61 domains (unverified)
Data compromised
Actor-claimed ~4.4M database records, 58,423 ID document photographs, mobile app source code (Ionic), and SECOP II public-procurement contact tables across 61 Colombian domains—unverified; Hostinger had not confirmed at catalog time
Technical writeup
Unverified criminal-forum claim — observed July 11, 2026. Threat-intelligence reporting summarized actor DozerMx advertising extraction of approximately 4,418,729 database records, more than 58,000 identification photographs, and source code from 61 domains on Hostinger shared hosting in Colombia. The listing allegedly includes tables tied to Colombian public-procurement (SECOP II) contacts with names, tax IDs, phones, and addresses, plus compressed archives of ID card images (fotosCarnetizados.tar.gz). VECERT Radar and similar trackers noted no confirmation from Hostinger, ColCERT, or Colombia's Superintendency of Industry and Commerce at indexing time. BreachHistory indexes the actor-cited 4,418,729 record count as unverified.
Root cause
Unverified underground forum listing by actor DozerMx alleging compromise of shared Hostinger Colombia hosting affecting 61 domains