SUNAT Taxpayer Registry

Informazioni su questa violazione

In February 2023 (first circulated in December 2022), a database containing Peru's SUNAT (Superintendencia Nacional de Aduanas y de Administracion Tributaria, the national tax authority) taxpayer registry — the "Padron Reducido RUC" — was distributed on hacking forums and Telegram channels, exposing approximately 13 million taxpayer records. Each record contained the taxpayer's RUC (Registro Unico de Contribuyentes tax identification number), full name or business/legal name (razon social), taxpayer status, domicile condition, and registered tax domicile address (street, number, district and UBIGEO code). The majority of records belong to natural persons registered as taxpayers; the remainder are companies and other legal entities. The "padron reducido" is a reduced taxpayer roster that SUNAT itself publishes as semi-public data, so the information is not fully confidential; the leaked file aggregated it into a single bulk dataset. The records were shared among breach-trading forums and Telegram channels.