malconguerra2 calls for an attack on Krece
On March 4, 2026, a threat actor using the alias malconguerra2 claimed on BreachForums to have leaked approximately 6 million confidential records attributed to the Venezuelan app Krece. That same day (March 4, 2026), Krece issued an official statement confirming unauthorized access to part of its systems, resulting in the exposure of company and user data, though it maintained that login credentials and payment data remained intact and that services continued to operate normally (reported by elDiario.com and prensaoriente.com.ve on March 5, 2026). The figure of ~6 million records remains a claim by the actor/media that has not been independently verified.
Overview
Missing evidence
Impact details
Krece publicly acknowledged the unauthorized access and exposure of some company and user data, although it stated that passwords, payment information, and service availability were not affected. The figure of 6 million records is based on a claim made by an individual or media outlet and has not been confirmed by Krece.
Classification & severity
- Category
- Information content security
- Subtype
- Leak of confidential information
- Confidence
- Medium
Severity assessment
Medium- Functional impact
- None
- Information impact
- Personal data
- Affected scope
- Multiple users
- Critical service
- None
- Public confidence
- Limited
- Recoverability
- Regular
The company’s statements released to the media confirm that there was an unauthorized access incident and some data exposure, but not the alleged scale of 6 million records, nor the compromise of passwords or payment information.
Timeline
malconguerra2 listed Krece as an alleged victim.