Leak of confidential information

Operation Hecatombe: Alleged Data Breach Involving SAIME, SAREN, and the Border ID Card

On May 8, 2026, L4TAMFUCKERS/GordonFreeman claimed on dark web sources and through OSINT monitoring that an alleged “Operation Hecatombe Venezuela” was targeting the Venezuelan government’s identity systems. The alleged data set combines a SAIME biographical database of approximately 35.2 million records, SAREN civil documents totaling several terabytes, and approximately 92,000 Border ID card records. The publicly available evidence supports a single bundled claim/operation, not separate intrusions by agency. No official confirmation or independent verification of authenticity was found. Cashea is excluded from this record because it appears in related news reports as a separate claim.

Overview

Missing evidence

Official confirmation from SAIME or SARENIndependent validation of the sampleDiscrepancy in the SAREN count when reviewing the original forum screenshotSeparate evidence of biological intrusion

Impact details

48,692,000 Exposed records

Unverified claim by L4TAMFUCKERS/GordonFreeman: SAIME, approximately 35.2 million biographical records; SAREN, approximately 13.4 million birth and civil registry documents; and Carnet Fronterizo, approximately 92,000 records. No official confirmation or independent validation of authenticity has been found.

ID cardfull namesgenderdate of birthoccupationlog dates

Classification & severity

Category
Information content security
Subtype
Leak of confidential information
Confidence
Medium

Severity assessment

Severe
Information impact
Suspected
Affected scope
National
Critical service
Potential
Public confidence
Significant
Data exfiltration· Claimed Confidentiality

Timeline

Claim

Threat intelligence alerts (Vecert Analyzer, Brinztech, Dark Web Intelligence) have appeared regarding the L4TAMFUCKERS group’s claim (“Operation Hecatombe”) that it compromised SAIME, SAREN, and Carnet Fronterizo.

Disclosure

Venezuelan media outlets (La Verdad, Primera Edición, El Nacional, TalCual, Correo del Caroní) report an alleged massive data breach involving SAIME, SAREN, and Cashea, citing alerts from Vecert Analyzer.

Update

Media coverage continues; experts warn of the risk of fraud. No official authority has confirmed the authenticity of the leaked data.

Evidence & sources

14 sources

Alleged leak of sensitive data exposes records from Saime, Saren, and Cashea

La Verdad May 11, 2026
Primary Media report

Possible Data Breach at Saime and Saren Detected

Noticias de Aquí May 12, 2026
Corroborating Media report

Possible Massive Data Breach of Saren, Saime, and Cashea Records Detected

Primera Edición May 11, 2026
Corroborating Media report

Warnings Issued About Alleged Massive Data Breach at Saime, Saren, and Cashea

Correo del Caroní Jun 19, 2026
Corroborating Media report

Alleged catastrophic breach in the Venezuelan government’s systems

Brinztech May 9, 2026
Attribution Security research

Dark Web Informer: IMPORTANT ALLEGATION: SAIME, SAREN, and the Border ID Card Program May Have Violated Regulations

Dark Web Informer (X) May 1, 2026
Attribution Threat actor claim

Dark Web Information: A malicious actor claims to have carried out a data breach at SAIME, SAREN, and Carnet Fronterizo

Dark Web Intelligence (X) May 1, 2026
Attribution Threat actor claim

Possible Massive Data Breach of Saren, Saime, and Cashea Records Detected

El Nacional May 1, 2026
Corroborating Media report

Warnings Issued About Alleged Massive Data Breach at Saime, Saren, and Cashea

TalCual May 1, 2026
Corroborating Media report

Complete SAIME Database (35.2M) + SAREN Birth Certificates (13.4M) + Border ID Card (92K)

darkforums.ru May 9, 2026
Primary Threat actor claim

May 9, 2026, 9:00:00 AM | High-quality snowflakes

00sec.com May 9, 2026
Corroborating Security research

Warning Issued About Alleged Massive Data Breach at Saime, Saren, and Cashea – Correos de Caroní

correodelcaroni.com May 10, 2026
Corroborating Media report

HackNotice mirror of SAIME/SAREN/Border Card claim

HackNotice May 8, 2026
Primary Security research

35 million Venezuelans exposed? Dark web actors claim there has been a massive data breach of the identity systems of SAIME, SAREN, and border authorities

UnderCode News May 11, 2026
Corroborating Security research