Salvadoran Citizens Data Breach (2024)

On April 2, 2024, the personal information of 947,000 Salvadoran citizens appeared in a public data dump on a popular hacking forum, exposing names, dates of birth, email addresses, phone numbers, physical addresses, government-issued IDs, and more than 5 million profile photos.

Details Confirmed in the Disclosure

The breach record published by Have I Been Pwned states that nearly 6 million records were released, containing data on 947K unique individuals. The exposed information includes full names, dates of birth, phone numbers, physical addresses, government-issued IDs, email addresses, and corresponding profile photos. The disclosure does not specify how the data was initially obtained or which government or private system it came from. It also does not indicate whether the incident involved ransomware or another intrusion method.

April 02, 2024 marks the first public listing of this dataset. The notification makes clear that the material was already circulating among threat actors before it reached the forum.

Why This Matters for You and Your Family

If you or any member of your household has ties to El Salvador, your full contact details, official identification, and likeness may now be available to anyone who downloads the archive. This combination of data lets criminals build convincing profiles for identity theft, loan fraud, or targeted scams. A thief who knows your name, address, date of birth, and government ID number can more easily impersonate you when dealing with banks, utilities, or government agencies. Profile photos make social-engineering attacks, such as phishing calls or fake social-media profiles, far more believable.

Even if you no longer live in El Salvador, the breach can still affect family members who remained behind. Shared addresses and phone numbers link relatives together, increasing the chance that one person’s exposure puts others at risk.

Doxxing and Identity-Chain Risks

The released dataset creates long-term doxxing hazards. Threat actors can cross-reference the government IDs, addresses, and photos with information from other leaks to map entire family networks. Once an attacker connects your real name and address to an email address or phone number, they can hunt for associated online accounts. Credential leaks of this kind frequently cascade into gaming-platform takeovers, especially for children and teenagers who reuse passwords or security questions. A compromised Roblox, Fortnite, or Discord account can then be used to extract more personal details or to harass the account owner.

These identity chains grow over time. What begins as a simple list of names and addresses can later fuel stalking, swatting, or extortion campaigns months or years after the initial leak.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you have used with Salvadoran government services, banks, or email accounts and enable 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure that touches you or your family is caught and addressed in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address and identity details.
• Let remediation specialists handle takedown requests for any data-broker listings that surface your Salvadoran records.

The incident shows that even large-scale government-related datasets can surface without warning and remain useful to criminals long after the initial publication. Protecting yourself requires ongoing vigilance rather than a one-time check. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting your DoxxScan trial gives you and your family the clearest view of what is already exposed and a practical way to begin closing those doors.