Ministry of Defense of Peru Listed by ransomexx Ransomware Group

On March 24, 2024, the Peruvian Ministry of Defense appeared on the leak site operated by the ransomware group known as RansomEXX. The listing states that internal files totaling 763.8 GB were exfiltrated during a ransomware attack. Anyone whose personal information appears in those files—service members, civilian employees, contractors, or family members whose records were stored on ministry systems—now faces heightened risk of identity theft and targeted fraud.

Reported Details from the Listing

The RansomEXX leak page explicitly names the Ministerio de Defensa del Perú and claims the data was taken in a ransomware operation. It does not specify the exact types of records stolen beyond “internal files,” nor does it list the number of affected individuals. The disclosure indicates the files were exfiltrated and are now published for anyone to download. No ransom demand figure or payment deadline is shown in the public listing.

Why This Matters for You and Your Family

Government agencies like Peru’s Ministry of Defense routinely hold sensitive personal data: national identification numbers, military service records, family contact details, payroll information, and medical or security-clearance files. When that information reaches a public leak site, criminals can use it to impersonate victims, file fraudulent tax returns, open accounts in their names, or sell the details on underground markets. Even if you or your family have never served in the Peruvian military, shared household records or dependents’ information can still be exposed. The breach therefore creates concrete financial and privacy risks for ordinary people whose data happened to sit on the compromised systems.

Doxxing and Identity-Chain Risks

A single government breach rarely stays isolated. Leaked military or defense-related records often contain email addresses, phone numbers, and government IDs that attackers can cross-reference with other breaches. This creates long identity chains linking your work identity to personal accounts, social-media handles, and even children’s online profiles. Credential leaks of this kind frequently cascade into gaming-account takeovers, where stolen passwords grant access to platforms that store additional personal details or payment methods. The result is accelerated doxxing: once one thread is pulled, attackers can map an entire household’s digital footprint within days.

RansomEXX’s Known Track Record

Public reporting attributes RansomEXX with emerging in 2020 and focusing primarily on double-extortion tactics—encrypting victim networks while simultaneously exfiltrating data for later public release. The group has previously listed manufacturing firms, healthcare providers, and other government entities across Latin America and Europe. Their typical playbook begins with initial access through phishing or exploited remote-desktop services, followed by lateral movement to locate high-value file shares, exfiltration over several days, and finally publication on their onion-site when negotiations fail. The Peruvian Ministry of Defense listing follows this established pattern.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Rotate any password used for Peruvian government, military, or related contractor portals anywhere it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same leaked address or parent email.
• Let DoxxScan remediation specialists manage takedown requests for any exposed personal documents appearing on data-broker or underground sites.

The incident underscores that even large state institutions remain vulnerable, and the data they hold can quickly become ammunition for identity thieves. One practical step now can prevent months of cleanup later. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts—capabilities designed precisely for threats like the RansomEXX leak.