15 GB of Central Bank of Venezuela Employee Medical Records

Data Breach Summary

A major data leak has exposed 15GB of sensitive medical records belonging to employees of the Central Bank of Venezuela (BCV). The breach occurred on June 10, 2025, and was posted on a dark web forum by a user known as Cypher404x. The leaked data includes medical appointment logs, scanned ID documents, treatment records, and other personal files in PDF format.

The attacker also claimed to have full access to the BCV network and hinted at releasing even more classified information in the near future.

---

Where and How?

The breach was shared on the underground forum darkwebforums.st, where the attacker uploaded four downloadable archive links containing sensitive internal documents. The files appear to have been exfiltrated directly from the institution’s internal systems, pointing to a critical failure in cybersecurity protocols.

Alongside the leak, the attacker posted a message taunting the Central Bank and warning that additional confidential documents may soon be exposed.

Company Data Breach History

There are no previous known incidents involving the Central Bank of Venezuela’s internal networks or employee data. This leak represents the first major exposure of sensitive medical and identification records from the institution, underscoring the urgent need for better internal data protection and access control systems.

---

Recommendations for Personal Data Protection

For affected individuals:

• Immediately monitor personal accounts and medical portals for suspicious activity.
• Avoid clicking on unknown links or downloading unsolicited documents.
• Contact relevant authorities if any personal ID or medical record appears to be misused.
• Enable strong passwords and two-factor authentication wherever possible.
• Be cautious of potential phishing campaigns that reference your health or identity.

---

Further Action

The Central Bank of Venezuela should urgently:

• Investigate the breach and assess its full scope.
• Notify all impacted employees about the nature of the exposure.
• Cooperate with national cybercrime units and data protection agencies.
• Audit and strengthen their internal IT infrastructure.
• Publicly commit to improving employee data security moving forward.

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.