Summary

• A seller on a cybercrime forum advertised about 38 million SIPA records for roughly 9.5 million Argentine citizens, offered as a SQLite database with a 400,000-record sample.
• The claimed fields include full names, DNI and CUIL numbers, addresses, CBU bank details, pension and benefit status, payment amounts and payment dates.
• ANSES told the fact-checking organization Chequeado it had not been hacked. The breach has not been independently verified.
• 38 million records does not mean 38 million people: one person can have many records for payments, applications and status changes.
• The main risk is targeted phishing around pension payment dates, benefit updates and identity checks, using fake ANSES portals and WhatsApp messages.

What is the alleged SIPA data leak?

The alleged SIPA leak is a forum listing that offers about 38 million records from Argentina’s integrated social security system, which is administered by the National Social Security Administration (Administración Nacional de la Seguridad Social, ANSES). The seller asked for payment in a cryptocurrency such as Bitcoin or USDT.

According to Dark Web Informer and DiarioBitcoin, the dataset was offered as a structured SQLite database, with a sample of about 400,000 records in JSONL format.

The advertised fields include:

• Full names, dates of birth, province, locality, and postal codes.
• DNI (national ID) numbers and CUIL (social security) identifiers.
• Email addresses, residential addresses and phone numbers.
• CBU (bank account) and other banking information.
• Pension and benefit identifiers, benefit status, payment amounts and payment dates.
• Pension application and other administrative information.

These are fields claimed by the seller. Their presence in an advertisement does not prove the database exists, that it is authentic or that it came from SIPA.

Is the SIPA breach confirmed?

No. ANSES told Chequeado that it had not been hacked and, at the time of reporting, did not know about a matching incident. Dark Web Informer and other sources covering the original post also describe the claim as unverified.

There is no verified public evidence of how or when the data was obtained, from which system it originates, whether the records are genuine or current, or whether the full dataset exists. DiarioBitcoin noted that the listing did not explain how or when the data was accessed.

A threat actor claiming to hold a database is an intelligence signal, not proof of compromise. Sellers often inflate dataset size, recycle older leaks, combine sources or fabricate listings to attract buyers.

Why does 38 million records not mean 38 million people?

The listing itself says the 38 million records correspond to about 9.5 million unique citizens. A pension database can hold several records per person: benefit transactions, historical payments, applications and status changes.

The scale is therefore technically possible. In 2008, ANSES was publicly reported to hold tens of millions of personal records and extensive pension payment history. That history does not prove the 2026 dataset is legitimate. It only shows that more records than people is normal for this type of system.

What makes this kind of dataset dangerous for phishing?

A dataset that combines identity, location, benefit and bank data helps an attacker convince the victim of their legitimacy, which removes the usual reasons for suspicion. The combination is what matters:

Name + DNI + CUIL + address + pension status + expected payment date + bank details.

With that context, a fraudulent message can reference the victim’s real name, locality, benefit, approximate payment date and government identifier, and then ask for the one thing the attacker does not have yet. For example: “We detected an issue with your pension payment. Please verify your identity to avoid a delay in your next deposit.”

The link leads to a fake government portal that asks for credentials, a one-time password, bank details or a photo of the DNI. The leak does not need to contain passwords to make this attack work. It only needs to make the story believable.

How does a data leak turn into a phishing campaign?

Leaked data becomes a targeting layer for later attacks. The usual sequence is:

1. Data exposure: personal and benefit records reach criminal markets.
2. Victim profiling: attackers segment people by location, age, benefit type or payment schedule.
3. Infrastructure creation: lookalike government domains, fake portals and WhatsApp numbers go live.
4. Personalized phishing: messages are timed to pension payment dates, benefit updates, identity checks, bank detail changes, or suspended benefits.
5. Credential theft and fraud: stolen logins, codes and bank details lead to account takeover or diverted payments.

The first stage can happen months before the first phishing message, which is why defenders should prepare before a malicious domain goes live.

What should organizations and citizens do now?

Organizations should assume the data may be used and watch for the infrastructure that would use it. Practical steps:

• Government agencies and banks: monitor for lookalike domains and fake portals that use ANSES, Mi ANSES or bank branding, and take them down quickly.
• Banks and fintechs: add extra checks for CBU changes and new payment destinations, especially around pension payment dates.
• Messaging channels: watch for fake WhatsApp and social media accounts that claim to be ANSES or bank support.
• Citizens: access ANSES only by typing the official address or using the official app, never through links in messages, and never share one-time codes or DNI photos.

How PhishFort helps

When personal data leaks, attackers build fake portals and support accounts around the trusted brand. PhishFort Brand Protection monitors for lookalike domains, fake portals, and impersonation accounts and takes them down with registrars, hosts, and platforms.

Frequently asked questions

Was ANSES hacked?

ANSES told Chequeado it had not been hacked and had no knowledge of a matching incident. A threat actor claims to sell 38 million SIPA records, but the claim has not been independently verified.

What data is in the alleged SIPA leak?

The seller claims the dataset includes names, DNI and CUIL numbers, addresses, phone numbers, email addresses, CBU bank details, pension and benefit status, payment amounts and payment dates. These fields come from the listing and are not verified.

How could leaked pension data be used for phishing?

Attackers could send messages that use the victim’s real name, benefit and payment date to make a fake ANSES or bank request look legitimate, then collect passwords, one-time codes, bank details or DNI photos through a fake portal.

How can I tell if an ANSES message is fake?

Treat any message that asks you to verify your identity, update bank details or avoid a payment delay through a link as suspicious. Access ANSES only through the official website or app, and never share one-time codes or photos of your DNI.

Sources

• Chequeado fact check on the alleged ANSES leak, September 2026.
• Dark Web Informer report on the SIPA listing, September 2026.
• DiarioBitcoin report on the alleged SIPA database sale, September 2026.