ColombiaGovernment
Citizen & Employment Data
For Sale
Unverified
SENA Colombia Database Sale Claim Lists 20.56 Million Citizen Records With Identity, Contact and Employment Data
Overview
An actor using the handle “koii” claims to be selling a database associated with Colombia’s Servicio Nacional de Aprendizaje (SENA). The post advertises 20,564,434 unique records and describes the data as nationwide in scope.
The listing says the dataset contains identity and demographic information alongside a broad professional and academic profile, including names, document identifiers and types, dates of birth, addresses, phone numbers, email addresses, occupational profiles, academic history, work experience, training, languages, internships and driver’s-license information. The files are described as JSONL and database formats. The dataset, its source, the stated record count and current availability have not been independently verified.
Post details
ColombiaWhat the post claims
- 20,564,434 unique records
- Colombia-wide coverage
- First and last names included
- Document type and document number included
- Date-of-birth field included
- Address, municipality and department fields included
- Primary and alternate phone numbers included
- Email addresses included
- Occupational-profile information included
- Achievements / accomplishments included
- Academic-history information included
- Work-experience information included
- Training / certifications included
- Languages included
- Business-internship information included
- Driver’s-license information included
- JSONL and DB formats
- Free sample advertised
The screenshots show a database schema and sample records containing direct citizen identifiers and contact information. Those individual records, names, document numbers, birth dates, addresses, phone numbers and email addresses are not transcribed in this report.
Screenshots
IOCs & identifiers
Identifiers directly visible in the supplied material. These support correlation and do not independently verify the dataset claim.
| Type | Identifier | Source |
|---|---|---|
| Actor handle | koii |
Screenshots 1–2 |
| Group | PampaLeaks |
Screenshots 1–2 |
KOII337@proton.me |
Screenshot 2 | |
| Session ID | 0532d3791d79cb78f3bcc82a4b3bb236d732d3096804d62a29cb8a045a3790811f |
Screenshot 2 |
| Telegram | @dinastiakoi |
Screenshot 2 |
No malware hash or attacker-controlled IP address is visible in the supplied screenshots. Citizen identifiers and personal data shown in the sample are intentionally not reproduced in this table.
Mapped techniques
Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.
-
Collection
T1213.006
Data from Information Repositories: Databases
Inferred
The listing presents a large structured database containing identity, contact, academic, employment and professional-profile fields. The supplied material does not disclose how the data was obtained or independently establish unauthorized access to SENA systems.
Potential impact
If authentic, the claimed exposure could affect millions of individuals by exposing national document identifiers, names, dates of birth, addresses, phone numbers, email addresses, academic history, work experience, training and professional-profile information. The combination could support identity fraud, targeted phishing, impersonation, employment-related fraud or broad profiling of Colombian citizens.
Status Unverified
Dark Web Informer has not independently verified the dataset’s authenticity, source, completeness, 20,564,434-record count, sample contents or current availability. The supplied screenshots document the listing and visible samples, not independent confirmation of the underlying database.
Source: Dark Web Informer · 2026-11-04