Overview
- Journalists and researchers reported on Friday that a dataset tied to Buró Laboral México includes about 2.42 million records covering roughly 766,968 workers and 1,479,630 labor histories, and that a group calling itself ETERNAL posted a companies file for free while offering the full worker database for sale on Telegram for 3,500 pesos.
- The leaked entries reportedly contain highly sensitive identifiers such as full names, RFC, CURP, IMSS numbers, dates of birth, salaries, Infonavit credit data and detailed records of labor claims and employment timelines.
- Cybersecurity researcher Hiram Alejandro found roughly 550–560 distinct corporate domains in the files and used contacts at three companies to partially confirm that some worker names and HR staff listed in the leak match real records.
- The attacker’s claim of responsibility has been linked in reporting to previous incidents, but investigators and platform operators have not publicly confirmed how the data was extracted or attributed the breach conclusively, and probes are ongoing.
- Affected workers face risks of identity theft and exclusion from hiring through informal blacklists, and they can seek remedies under Mexico’s labor and data-protection rules by filing complaints with the STPS, PROFEDET, CONAPRED or the federal data-protection authority and pursuing civil claims where appropriate.