RegistroCiberVE
All incidents
Leak of confidential information Public report: Date confidence: Low

Presunta extracción de datos de SAIME, SAREN y Carnet Fronterizo en Operación Hecatombe

La supuesta extracción de datos de SAIME, SAREN y Carnet Fronterizo, denominada Operación Hecatombe Venezuela, fue atribuida a GordonFreeman, Izanagi y YoSoyGroot/L4TAMFUCKERS en una publicación del 8 de mayo de 2026 a las 22:25:07 UTC. El relato conecta SAIME, SAREN y Carnet Fronterizo mediante supuestas API/IDOR-BOLA y exfiltración por canales oficiales; otra fuente publicó una versión compatible el 9 de mayo. Una recapitulación informa 35 millones SAIME, 12,5 millones SAREN y 92.000 registros fronterizos; el primer anuncio informa 35,2 millones y 13,4 millones. Son cifras atribuidas distintas, no personas únicas o volúmenes autenticados. El hilo original tiene fecha del 9 de mayo, que no fija adquisición ni explica el orden de publicaciones. El relato presenta una operación conectada alegada, sin mecanismo, origen, escala, actor o impacto confirmados. Cashea queda fuera; no se examinaron muestras o imágenes con datos personales.

Overview

Missing evidence

respuesta oficial de SAIME, SAREN o autoridad competentecorpus y muestras preservados con hash y cadena de custodiavalidación independiente no sensible de autenticidad, procedencia y vigenciaendpoints, solicitudes, controles y telemetría que prueben API/IDOR-BOLA, encadenamiento y túnelespersonas, sistemas, volumen e impacto confirmados

Impact details

El hilo publica texto estructurado e imágenes que aparentan contener datos personales, credenciales y documentos civiles. Esto demuestra el contenido público del reclamo, no autenticidad, procedencia, acceso, exfiltración ni los volúmenes alegados de 35/35,2 millones, 12,5/13,4 millones, 92.000 o 6 TB. Los valores personales no se reproducen aquí.

registros biográficos aparentes de SAIMEdocumentos civiles aparentes de SARENregistros aparentes de movilidad fronteriza con identidad, contacto y credencialessistemas atribuidos a identidad, registro civil y movilidad fronterizarespuestas estructuradas y texto SQL aparentesimágenes de documentos PDF aparentes

Classification & severity

Category
Information content security
Subtype
Leak of confidential information
Confidence
Low

El foro expone aparentes registros y documentos personales, pero autenticidad, procedencia, adquisición, corpus y escala no fueron validados.

Severity assessment

Information impact
Suspected
Public confidence
Moderate

Las muestras aparentes implican datos de identidad y documentos civiles de alto riesgo potencial, pero autenticidad, alcance, personas afectadas y efecto material no fueron validados.

Data exfiltration· Claimed

Timeline

Disclosure

El reclamo agrupado circuló en dos alertas antes de la fecha visible del foro; documenta circulación pública, no una intrusión confirmada.

Claim

GordonFreeman publicó Operación Hecatombe, atribuyó el reclamo a L4TAMFUCKERS, nombró a Izanagi y YoSoyGroot y mostró muestras aparentes. La fecha es de publicación, no de intrusión.

Update

Monitores y medios amplificaron cifras incompatibles y mezclaron el reclamo separado de Cashea; las fuentes seguían indicando que no había validación independiente ni confirmación oficial.

Evidence & sources

14 sources

Presunta filtración de datos sensibles expone registros del Saime, Saren y Cashea

La Verdad / Agencias May 11, 2026
Context Media report Source confidence: Low

What this source supports

  • reports the SAIME/SAREN/border allegation and explicitly says no authority validated it
  • also combines the separate Cashea allegation

Evidence limits

Derivative agency copy supplies no sample or independent validation and conflates Cashea.

Relevance to this case

Context for Venezuelan circulation and explicit lack of official confirmation; not proof of the bundled claim.

Detectaron posible filtración de datos de Saime y Saren

Noticias de Aquí / Redactor NDA M May 12, 2026
Context Media report Source confidence: Low

What this source supports

  • repeats the SAIME and SAREN allegations from VECERT
  • states there was no official confirmation

Evidence limits

Derivative article and screenshot do not authenticate any data.

Relevance to this case

Circulation and uncertainty context only.

Detectan posible filtración masiva de registros del Saren, Saime y Cashea

Primera Edición May 12, 2026
Context Media report Source confidence: Low

What this source supports

  • repeats the SAIME, SAREN and border allegations
  • also combines the separate Cashea allegation

Evidence limits

Derivative reporting, no technical evidence, and Cashea is a different claim.

Relevance to this case

Venezuelan circulation context only.

Alertan sobre presunta filtración masiva de datos del Saime, Saren y Cashea

Correo del Caroní / TalCual May 10, 2026
Context Media report Source confidence: Low

What this source supports

  • reports the bundled allegation while explicitly saying it is not independently verified or officially confirmed
  • also covers separate Cashea claim

Evidence limits

Exact duplicate source URL; article credits TalCual and has no independent evidence.

Relevance to this case

Approval-only duplicate-source retirement candidate; retained because deletion was not authorized.

Alleged Catastrophic Breach of Venezuelan Government Systems

Brinztech / Threat Alert May 9, 2026
Context Security research Source confidence: Low

What this source supports

  • repeats the actor claim and the 12.5M/35M/92K figures
  • presents hypothetical IDOR/BOLA/API chaining and tunneling consequences

Evidence limits

The technical narrative is extrapolated from actor wording; it includes no independent test, telemetry or sample validation.

Relevance to this case

Risk-analysis context only, not confirmation of the alleged mechanism or breach.

MAJOR CLAIM: SAIME, SAREN, and Carnet Fronterizo allegedly breached

Dark Web Informer (@DarkWebInformer) May 8, 2026
Corroborating Social media Source confidence: Medium

What this source supports

  • attributes the bundled claim to L4TAMFUCKERS and names GordonFreeman, Izanagi and YoSoyGroot
  • repeats alleged API/IDOR/BOLA/tunneling methods and 35.2M/13.4M/92K figures

Evidence limits

OSINT amplification of actor material; blurred document images and claim text are not independent authentication.

Relevance to this case

Corroborates public circulation and claim wording/date only.

Threat actor group claims breach of SAIME, SAREN, and Carnet Fronterizo

Dark Web Intelligence (@DailyDarkWeb) May 9, 2026
Corroborating Social media Source confidence: Medium

What this source supports

  • reports the 35.2M/13.4M/92K bundled allegation
  • explicitly says authenticity, scale and origin remain unverified

Evidence limits

Secondary OSINT report derived from the forum claim.

Relevance to this case

Useful for its explicit uncertainty, not confirmation.

Posible filtración masiva de registros del Saren, Saime y Cashea

El Nacional May 11, 2026
Context Media report Source confidence: Low

What this source supports

  • repeats the government-system allegation from VECERT
  • also combines the separate Cashea allegation

Evidence limits

Derivative coverage; the embedded monitoring card is not a technical artifact and Cashea is separate.

Relevance to this case

Venezuelan circulation context only.

Alertan sobre presunta filtración masiva de datos del Saime, Saren y Cashea

TalCual / Emily Placencia May 9, 2026
Context Media report Source confidence: Medium

What this source supports

  • reports the bundled government claim and explicitly says it is unverified and unofficial
  • separately reports an unrelated Cashea claim

Evidence limits

The article republishes monitoring claims and offers no independent authentication.

Relevance to this case

Earliest complete Venezuelan media context and explicit uncertainty.

Full SAIME DB (35.2M) + SAREN Birth Certificates (13.4M) + Carnet Fronterizo (92K)

DarkForums / GordonFreeman May 9, 2026
Primary Threat actor claim Source confidence: Medium

What this source supports

  • GordonFreeman publicly authored the bundled Operation Hecatombe claim and named Izanagi and YoSoyGroot
  • the post alleges API exploitation, IDOR/BOLA, API chaining and tunneling exfiltration
  • the public body and images visibly contain apparent SAIME, SAREN and border-identity records

Evidence limits

Apparent personal records are visible, but no independent authentication, source-system proof, complete corpus, hash or chain of custody exists. Page 2 includes an uncorroborated accusation that the seller is a scammer.

Relevance to this case

Strongest primary provenance for the public claim and apparent sample categories, not proof of compromise, mechanism, scale or impact.

2026年05月09日 每日数据泄露快报

00sec / 零零信安 May 9, 2026
Corroborating Security research Source confidence: Low

What this source supports

  • attributes a 35.2M/13.4M/92K claim to GordonFreeman
  • states a total of 48,492,000 records

Evidence limits

Tracker offers no preserved sample or validation. Its stated total 48,492,000 conflicts with arithmetic on 35.2M + 13.4M + 92K (48,692,000), and the forum says SAREN 12.5M.

Relevance to this case

Circulation context only.

Alertan sobre presunta filtración masiva de datos del Saime, Saren y Cashea

Correo del Caroní / TalCual May 10, 2026
Context Media report Source confidence: Low

What this source supports

  • reports the bundled allegation while explicitly saying it is not independently verified or officially confirmed
  • also covers separate Cashea claim

Evidence limits

Article credits TalCual and supplies no independent evidence.

Relevance to this case

Canonical retained copy; source -3uQrVkRHHrAHphQTH5jI is the approval-only duplicate retirement candidate.

HackNotice mirror of SAIME/SAREN/Carnet Fronterizo claim

HackNotice
Context Security research Source confidence: Low

What this source supports

No supported claims are recorded for this source.

Evidence limits

The specific record is unavailable without authentication; current page exposes no incident content, date or evidence.

Relevance to this case

Approval-only source-retirement candidate; cannot support the incident now.

35 Million Venezuelans Exposed? Dark Web Actors Claim Massive Breach of SAIME, SAREN, and Border Identity Systems

UnderCode News May 8, 2026
Context Media report Source confidence: Low

What this source supports

  • reports the 35.2M/13.4M/92K allegation
  • explicitly states that no technical proof, independent validation or official confirmation exists

Evidence limits

Secondary synthetic-style analysis derived from monitoring posts; no sample or forensic artifact.

Relevance to this case

Useful only for explicit limitations and circulation.