Universidad Santiago de Cali Data Leak

Data Breach Summary

Data Breach Overview

A significant breach has surfaced on the dark web forum darkforums.st, where the user “aero” leaked over 127 CSV/XLSX files containing sensitive institutional data from Universidad Santiago de Cali (ID: 1829). The information appears to be extracted from SNIES (Sistema Nacional de Información de la Educación Superior), Colombia’s national higher education information system.

The leaked files include:

• Academic study levels
• Enrollment and registration data
• Details of national entities
• Document and ID types
• Financial and expense accounts
• Administrative and operational data
• Files such as Colegio.csv, IES.csv, and others

This dataset paints a comprehensive picture of the university’s internal structure and operations.

Where and How?

The files were publicly shared on darkforums.st, a forum known for distributing leaked and illicit data. The leak was posted directly by the user “aero” and includes highly structured documents, suggesting direct access to institutional systems or mismanaged data repositories.

Company Data Breach History

As of now, there are no previous confirmed data breaches involving Universidad Santiago de Cali. However, this incident reveals critical weaknesses in either the institution’s cybersecurity practices or in how SNIES-related data is handled and stored. It raises urgent questions about access control, data segmentation, and third-party handling of educational records.

Immediate Recommendations

The affected institution should urgently:

• Launch an internal investigation to trace the origin of the breach
• Audit all systems connected to SNIES and enforce stricter access controls
• Notify relevant authorities and comply with data protection regulations
• Inform potentially affected students and staff transparently

Immediate Recommendations

Authorities and impacted institutions should urgently:

• Identify the source system or leak vector.
• Notify affected individuals and consider providing identity protection services.
• Strengthen data access controls and encryption policies.
• Audit current systems for additional vulnerabilities.

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.