Nearly 1 Million Salvadoran Citizens’ Personal Records Exposed in Data Breach
What Happened — In April 2024, a hacking forum published the personal data of 946,989 Salvadoran citizens. The dump contained names, dates of birth, government‑issued IDs, email addresses, phone numbers, physical addresses and roughly one million profile photos.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient data‑handling controls and the need for continuous evidence that protection measures are operating as intended.
- Highlights the importance of a documented, auditable process for privacy‑impact assessments and breach‑response readiness.
- Shows how a single control gap (e.g., lack of encryption at rest or inadequate access reviews) can trigger a large‑scale exposure that must be reported under multiple privacy frameworks.
Who Is Affected – Public‑sector agencies in El Salvador and any service providers that store or process Salvadoran citizen data.
Recommended Actions – Review and map your data‑protection controls to the relevant privacy objectives, collect evidentiary logs (encryption status, access logs, data‑retention policies), and validate that breach‑response playbooks address the full data set scope. Source: Have I Been Pwned – Salvadoran Citizens breach
Technical Notes – The breach appears to stem from a third‑party data repository; no specific vulnerability or CVE was disclosed. Exposed data types include personally identifiable information (PII) and biometric‑type profile photos. Source: same as above