RENAPER national ID database breach

In October 2021, an anonymous actor demonstrated they had obtained the complete identity records of Argentina's entire population — roughly 45 million people — held by RENAPER (Registro Nacional de las Personas), the agency that issues every national ID card (DNI) in the country.

What happened

The breach surfaced publicly when a freshly created Twitter account, @AnibalLeaks, began posting the official ID-card photographs and personal details of 44 well-known Argentines, including President Alberto Fernández, football stars Lionel Messi and Sergio Agüero, and numerous journalists and politicians. The hacker then advertised a service on a hacking forum offering to look up the personal data of any Argentine citizen for a fee.

Argentina's Ministry of Interior acknowledged unauthorized access but disputed that a bulk "breach" had occurred. Its security team traced the activity to a VPN account assigned to the Ministry of Health that had been used to query RENAPER for the exact 19 photographs published on Twitter "in the exact moment" they appeared. Authorities opened an investigation into eight government employees suspected of involvement. The hacker contradicted the official narrative, claiming to hold a full copy of the RENAPER dataset.

Impact

• Exposed records included full names, home addresses, dates of birth, gender, ID issuance and expiry dates, labor identification codes (CUIL), trámite numbers, citizen numbers, and government photo IDs.
• Because RENAPER is the authoritative source for Argentine identity, the data is effectively permanent — citizens cannot change their DNI number, date of birth, or biometric photo.
• The hacker threatened to release the records of 1 to 2 million people and to continue selling lookups to interested buyers.

Why it matters

The RENAPER incident is a textbook example of how a single over-privileged credential can expose an entire nation. The compromised account was not a sophisticated zero-day but a legitimate inter-agency VPN login that could query the country's most sensitive registry without rate limiting, anomaly detection, or per-record authorization.

Civil-rights organization Asociación por los Derechos Civiles (ADC) filed a formal request demanding RENAPER explain how the access controls failed and why no alerting caught the bulk queries. The case intensified debate over Argentina's aging Personal Data Protection Law (25.326) and the absence of meaningful breach-notification and minimization requirements for state-held biometric data. For a registry that underpins voting, banking, and welfare, the breach showed that centralizing a population's identity without commensurate access governance creates a single point of catastrophic failure.