An unattributed threat actor has claimed to have leaked approximately 5.8 million Uruguayan citizen records – roughly 1.7 times Uruguay’s population of 3.4 million – indicating aggregation across multiple government databases or historical sources. The breach claim follows a documented pattern of Latin American cybercriminal operations targeting government agencies to exfiltrate and sell citizen PII at scale. For organizations with Uruguayan operations, vendor relationships, or employees with Uruguayan identity documentation, the risk of downstream fraud, social engineering, and identity compromise is elevated.