A threat actor operating as cenfecracked is circulating what it describes as a full extract of the Mexican Presidency's citizen petition platform, covering more than 400,000 citizens and case files routed to 59 federal dependencies. Dark Web Informer, which documented the post on August 7, 2026, lists the incident status as unverified. Neither the Presidencia de la República nor the Agencia de Transformación Digital y Telecomunicaciones (ATDT) has publicly confirmed a breach, a silence noted by Maya Comunicación, Undercode News, and every other outlet reviewed for this brief. What separates this from an ordinary unverified forum listing is that an independent thread, opened nine days earlier by Mexican cybersecurity journalist Ignacio Gómez Villaseñor, describes a concrete access-control flaw in the same system and the same 400,000 record population. The two accounts have not been formally connected, but they point at one platform.
What Happened
The target is the Presidency's citizen-facing intake portal, the digital front door to Palacio Nacional where members of the public file petitions, complaints, formal denuncias, and requests for assistance, then track case progress by folio number. Source naming is inconsistent across reporting: Guacamole Proyect and Maya Comunicación call it the Sistema Integral de Atención Ciudadana (SIDAC), while Dark Web Informer and Undercode News refer to the Sistema de Atención Ciudadana (SAC). These appear to describe the same platform.
Two disclosure tracks are visible in the sources.
The first is journalistic. Gómez Villaseñor documented the exposure publicly during a broadcast of Me Lo Dijo Adela, hosted by Adela Micha on the La Saga platform, and the story was picked up by Guacamole Proyect on July 28 and by Maya Comunicación and Intra Conexión on July 29 and 30. In that account, the exposure was not an intrusion in the conventional sense but a security failure that permitted download of 59 files, one per federal dependency. Intra Conexión and xeu report that the official portal was offline for roughly two days at the time of their interviews with him.
The second is underground. Undercode News reported on July 28 that Dark Web Intelligence (@DailyDarkWeb) had flagged an alleged leak tied to the Presidencia de México, though that initial post carried no dataset size, no data types, and no proof of access. By August 7, Undercode was reporting a far more specific listing on a cybercrime forum: 400,000-plus citizen records, 59 government agencies, allegedly pulled from backend systems. Dark Web Informer's coverage the same day attributes the post to cenfecracked and includes a published schema, a partially self-masked sample record, and an explicit statement of intended use covering social engineering and phishing.
What Was Taken
Reported record volume is consistent at 400,000-plus across all sources, which is itself unusual and lends the figure weight. Guacamole Proyect and Maya Comunicación both specify that the records cover filings accumulated through February 2026; Dark Web Informer's post details simply date the records to 2026. The 59-agency figure is likewise consistent, and it is the more operationally meaningful number: it means the dataset is not one ministry's caseload but a cross-government slice.
Per the schema published with cenfecracked's post and reported by Dark Web Informer, the exposed fields allegedly include:
- Full names, dates of birth, occupation, and civil status
- CURP national identifiers and RFC tax identifiers
- Verified email addresses, phone numbers, and full home addresses
- Petition subject, full description text, category and sub-category
- Assigned federal agency, case status history, and response documents
- Internal official comments, assigned analyst names, and official handler email addresses
Guacamole Proyect independently lists names, home addresses, postal codes, emails, phone numbers, and case history, which corroborates the core identity and contact fields from a separate reporting track. Undercode News adds that the listing describes the data as available in JSON structures, SQL databases, and API response formats, a shape consistent with an application backend export or a poorly secured API endpoint rather than a filesystem grab.
The agency routing is the sharpest element. Guacamole Proyect and Intra Conexión both name the Secretaría de Seguridad y Protección Ciudadana, the Secretaría de la Defensa Nacional (SEDENA), the Secretaría de Marina, and the Guardia Nacional among the receiving dependencies. Gómez Villaseñor told Intra Conexión and xeu that the underlying complaints include reports of homicide, kidnapping, and other serious crime.
Where Accounts Differ
Defenders should treat three points as open.
Breach versus exposure. The Spanish-language reporting frames this as a vulnerabilidad and falla de seguridad, a flaw that allowed anyone to walk the data out. The forum listing frames it as extraction from backend systems. Those are compatible but not identical claims, and no source establishes that cenfecracked is the same party who found the flaw.
Distribution model. Dark Web Informer records the listing as free via a private channel. Undercode News describes a seller advertising the database on a cybercrime platform. Free distribution and paid sale imply different actor motivations and very different downstream spread; the sources do not reconcile.
Verification. Undercode News is explicit that its own reporting rests on an allegation with no confirmed technical evidence and no government statement, and correctly warns that actors publish false, recycled, or inflated claims. Every source in this brief is OTHER-tier. There is no victim statement, no regulator filing, and no CERT advisory. Treat the 400,000 figure as the actor's and the journalist's claim, converging but unconfirmed.
Why It Matters
Mexican identity infrastructure does not support revocation. CURP, RFC, legal name, date of birth, and home address are the primitives for identity verification across Mexican banking, government, and telecom. A citizen cannot be reissued a new CURP because a database leaked. As Dark Web Informer's impact assessment puts it, that alone would be serious.
The petition content is what elevates this beyond a standard PII dump. People approach the Presidency about illness, unemployment, poverty, and violence, generally when other channels have failed. The dataset, as described, binds each of those disclosures to a named individual at a verified address with a working phone number. Where a petition was routed to SEDENA, Marina, the Guardia Nacional, or SSPC, the record establishes that a specific person formally approached a security institution and what they said. In a country where the Proceso reporting in this same sourcing set documents cartel-adjacent violence as routine context, that is a targeting list, not a fraud dataset.
The internal directory compounds it. Analyst names, handler email addresses, and internal case comments give an attacker everything needed to impersonate a government caseworker to the exact citizen whose file they hold, referencing a real folio, a real complaint, and a real assigned agency. cenfecracked's own stated intended uses reportedly include social engineering and phishing.
There is also a pattern here. Gómez Villaseñor is the same researcher who, per Proceso on July 21, 2026, exposed the Hackers$ Crew compromise of four Sinaloa government systems in three days, spilling data on nearly a million people, including 817,000 Culiacán taxpayers with banking details and addresses. The Ayuntamiento de Culiacán denied the incident via an informational card, stating it had no alerts confirming any compromise, while the data sat in Telegram channels. Sinaloa state communications simply did not respond. Mexican public-sector breach response in 2026 is trending toward non-acknowledgement, and the federal silence on SIDAC so far fits that shape.
The Attack Technique
The only technical mechanism named in any source comes from Gómez Villaseñor, reported consistently by Guacamole Proyect, Maya Comunicación, Intra Conexión, and xeu: an IDOR (Insecure Direct Object Reference) flaw. Per his explanation, the platform exposed case records by folio number in the URL, and incrementing that number sequentially returned other citizens' files. In his words to Intra Conexión, changing a single number in the address bar was enough to reach another case file.
That is a missing authorization check, not an exploit chain. There is no malware, no credential theft, no phishing precursor, and no privilege escalation. The application authenticated the request but never asked whether the requester was entitled to that specific object. It is a category of flaw that scripts trivially and scales linearly, which is entirely consistent with a clean 400,000-record extract and with tidy per-agency file boundaries, one file per dependency.
Undercode News's description of JSON, SQL, and API-format availability supports the same reading: a machine-readable API returning records by identifier, harvested in bulk. Note that Undercode does not itself attribute the cause, and cenfecracked's post as summarized by Dark Web Informer does not disclose a method. The IDOR attribution rests on the researcher track alone.
What Organizations Should Do
Audit object-level authorization on every citizen-facing case system. IDOR does not show up in vulnerability scans or dependency audits. For each endpoint that returns a record by ID, folio, or reference number, test whether an authenticated session belonging to user A can retrieve user B's object. Do it for the API, not just the web UI, since the API is usually the older and less-guarded surface.
Replace sequential public identifiers. Folio numbers that increment are an enumeration invitation. Move to non-guessable identifiers such as UUIDs or signed opaque tokens, and treat that as a mitigation layered on top of authorization checks, never as a substitute for them.
Instrument for enumeration. Bulk extraction at this scale produces a distinctive signature: one session or one address walking record IDs in order at machine speed. Alert on high-cardinality object access per session, add rate limits per identity rather than per IP, and require step-up authorization for any bulk or export path.
Treat the case narrative as more sensitive than the identity fields. Free-text complaint bodies routed to defence, navy, and public security agencies deserve encryption at rest with separate key custody, stricter access logging, and shorter retention than the contact record. Bundling everything at one sensitivity tier is what turns a PII leak into a safety incident.
Segment cross-agency aggregation points. Any platform that fans out to 59 dependencies is a single point of catastrophic aggregation. Partition by receiving agency at the storage and authorization layer so that one flawed endpoint cannot return the whole federal corpus.
Pre-plan the disclosure, and use it. The Sinaloa precedent shows what non-acknowledgement costs: the data circulates anyway, and the institution loses the ability to warn the people it holds data on. Affected citizens need to be told to expect fraud and impersonation attempts referencing their real case details, and staff whose names and mailboxes appear in the directory need to be briefed on inbound social engineering that will cite genuine folio numbers.
Rotate and harden the handler side. If official email addresses and analyst names are in the wild, assume targeted phishing against those accounts. Enforce phishing-resistant MFA on internal caseworker accounts and monitor for lookalike domains impersonating the petition system to citizens.
Sources: Mexican Presidency's Citizen Petition System Allegedly Breached, 40... | Filtran datos de 400 mil denunciantes tras fallo de seguridad en Pr... | Vulneran SIDAC y exponen 400 mil peticiones dirigidas a Presidencia... | Hackeo a Presidencia habría expuesto 400 mil denuncias ciudadanas,... | Hackeo a Presidencia habría expuesto 400 mil denuncias ciudadanas,... | Alleged Dark Web Claim Targets Mexico’s Presidency: What a Reported... | Mexico Citizen Data in the Crosshairs: Alleged Government Database... | Ciberataque a gobiernos de Sinaloa expone datos de casi un millón d...