Threat Actor Claims to Sell 24 Million Confidential SENIAT Venezuela Tax Records, 30 GB

Summary

A threat actor using the alias malconguerra2 claims to be selling a 30 GB confidential dataset containing approximately 24 million records from SENIAT, Venezuela's national tax and customs authority. The alleged dataset includes personal data, passport information, tax IDs, national IDs, and company records for individuals, foreigners, and legal entities. The claim remains unverified, with only sample files posted to underground forums and the full dataset behind a paywall; SENIAT has not publicly acknowledged the breach.

Full text

Data24M records / 30 GB PriceTelegram sale CountryVenezuela Actormalconguerra2 ▣Post details TargetSENIAT (Servicio Nacional Integrado de Administración Aduanera y Tributaria) CountryVenezuela SectorGovernment / Tax & Customs ClaimConfidential dataset offered for sale Data24M records, JSON, 30 GB ObservedJun 1, 2026 PriceTelegram sale Actormalconguerra2 !Allegedly exposed ~24 million unique records (claimed) Personal data of individuals (naturals) Legal-entity / company records Foreign nationals' records Passport information Tax IDs (RIF) and registration data National ID / cédula holder data Government-related taxpayer data 23.6M CI-person JSON records 30 GB total, JSON format ␱Screenshots Screenshot 1 Redacted preview Screenshot 2 Redacted preview ⚠Potential impact If genuine, the exposure of 24 million records from a national tax authority, including identity, passport, and tax-registration data for individuals, foreigners, and companies, could enable large-scale identity theft, fraud, and targeting across much of the taxpaying population. Aggregated government and entity data would also be valuable for follow-on attacks and social engineering. Listings of this scale are also frequently exaggerated, recycled, or partly fabricated. iStatus Unverified A small sample file and JSON data excerpts were posted to an underground forum, with the full dataset behind a reply/upgrade paywall and a Telegram contact for buyers; the sample, links, and contact are not reproduced here. The claim has not been independently confirmed and SENIAT has not publicly addressed it. Large national-database listings are sometimes overstated or scams. Want the non-redacted screenshots? Paid subscribers get all of the claim details and unredacted screenshots, check out the threat feed or ransomware feed. View pricing → DARK WEB INFORMER - THREAT INTELLIGENCE

Indicators of Compromise

• malware — malconguerra2

Entities