3.9M Records Leaked from EsSalud Peru Database

Data Breach Summary

On May 26, 2025, cybersecurity monitors detected a major data leak involving the Peruvian public healthcare provider EsSalud. A total of 3,999,149 records were leaked and made available on the dark web forum DarkForums.st by a user operating under the alias InjectionInferno2. The compromised data includes full names, national ID numbers, birthdates, gender, geographic location, and even detailed employer information—posing serious risks to personal privacy and identity security.

Where and How?

The leak was discovered during routine dark web surveillance, when a combolist containing millions of lines of sensitive citizen data was posted on DarkForums.st, a known hub for cybercriminal activity. Based on the sample data shared, it appears that EsSalud’s database was breached through a vulnerability potentially linked to outdated data protection protocols, allowing the threat actor to extract and publish the records freely. The breach exposes a major flaw in the system’s data handling and encryption methods, especially considering the vast amount of personal and employment-related information involved.

Company Data Breach History

EsSalud has previously faced cyberattack warnings and minor data incidents, but this appears to be the largest and most damaging breach to date. In May 2024, reports emerged of suspicious activity on their internal servers, but the agency claimed no significant data loss at the time. This new incident raises serious concerns over EsSalud’s cybersecurity infrastructure and highlights the urgent need for system-wide audits and updates.

Further Action

Cybersecurity experts recommend EsSalud immediately investigate the breach origin, inform affected individuals, and implement emergency security patches. Transparency with the public and cooperation with law enforcement agencies will be crucial in minimizing the damage and preventing future attacks.

Recommendations for Personal Data Protection

How Users Can Protect Their Information
To safeguard personal information and accounts, users should consider the following steps:

• Change Passwords Regularly: Use strong, unique passwords combining letters, numbers, and symbols.
• Enable Two-Factor Authentication (2FA): Whenever possible, activate 2FA to add an extra layer of security to accounts.
• Use Unique Passwords for Each Account: Avoid reusing passwords across different platforms to prevent multiple account compromises.
• Be Cautious of Phishing Attempts: Stay vigilant against suspicious emails or messages that may contain malicious links or solicit personal information.
• Monitor Accounts for Unusual Activity: Regularly review account statements and activities to detect and respond promptly to unauthorized actions.

By adopting these practices, users can enhance their personal data security and reduce the risk of unauthorized access to their information.

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.