2026 InfoExperto — forum claim of 430M+ records (unverified); AFIP/telecom/KYC dump alleged
Data compromised
Actor-claimed multi-corpus dump (marketing total 430M+ rows, likely overlapping): ~100M AFIP Form 931 payroll links; ~65M AFIP padrón identity rows (DNI, DOB, addresses); ~176M telecom subscriber links (Personal/Telecom, Claro, Movistar); ~86M phone and ~30M email records from ANSES/IFE-style programs; 245k Banco Columbia card PANs plus 4,675 platform cards with plaintext CVV/expiry; 48k KYC biometrics; AFIP digital certificates and internal scrapers for AFIP/ANSES/BCRA/Movistar per listing
Technical writeup
Unverified criminal-forum claim — indexed July 7, 2026. Threat-intelligence reporting (MonThreat/X, July 7) summarized a dark-web listing alleging a dump of more than 430 million records from InfoExperto SA, a major Argentine credit bureau and data broker serving banks, fintechs, and law firms. The actor claims to have published partial source code, VPN keys, SSH root credentials, and production environment configs with hardcoded secrets—not only relational tables. Advertised datasets include AFIP Form 931 payroll/employer/salary links through April 2026 (~100M), AFIP padrón identity rows (~65M), telecom subscriber records across Personal/Telecom, Claro, and Movistar (~176M), ANSES/IFE/ENACOM-style contact tables (~86M phones, ~30M emails through June 2026), Banco Columbia cardholder PANs (~245k) plus thousands of platform-stored cards with plaintext CVV/expiry, ~48k KYC sessions with face-match scores and ID chip data, ~18M ART worker-compensation records, billing history for ~62k corporate clients, and AFIP digital certificates the poster claims could impersonate InfoExperto to query national registries. Totals are actor marketing figures and likely overlap across corpora; independent researchers and InfoExperto had not verified authenticity or freshness at catalog time. Distinct from renaper-argentina-api-sale2026 (June 2026 RENAPER API resale claim) and from July 2026 Chronus Team obras-sociales marketing. BreachHistory uses the actor-cited 430M headline count labeled unverified pending attestation.
Root cause
Unverified dark-web forum post alleging exfiltration from InfoExperto SA credit bureau/data-broker infrastructure including source code, VPN/SSH keys, and production configs—InfoExperto and Argentine authorities had not confirmed at catalog time