Hacker Posts 4800 Mexican Embassy Documents Online

• A hacker has posted a rich set of documents belonging to the Mexican embassy of Guatemala.
• Some documents are unimportant, but others contain classified information that was never meant to see the light.
• The embassy failed to protect the data and then failed again by not responding to the hacker’s warning.

The Mexican embassy in Guatemala saw multiple samples of their sensitive data getting posted online, following a compromise of their server by hackers. The person to put the dump online goes by the Twitter handle @0x55Taylor, and while the data was removed by the cloud hosting company that received the upload, many managed to access and even download them before the retraction. The hacker even claims to have contacted the Mexican official when he found the unprotected database, but they ignored the warning, so posting all 4800 documents online would be the next best thing for him to do as it seems.

https://twitter.com/0x55Taylor/status/1117702896752181248

Allegedly, the hacker is making ends meet partly by reporting problems and receiving bounty payouts for the discovered flaws, but when he gets ignored, the publication of the "problem" is the only way to pay back the negligence. This time, the Mexican embassy lost data such as thousands of passports belonging to citizens or even diplomats, visas, birth certificates, and even high-res scans of payment cards. As many of those depict sensitive data of high-profile emissaries, the leaking of the information can be considered a disaster for the embassy who will now have to put their people through a process of reissuing all of their papers.

Unfortunately, not everything can be mended. Highly sensitive data found in the dump include many letters that are signed by the ambassador, revealing the people who enjoy diplomatic immunity in Guatemala, and in many cases, the specific reasons. Other documents in the dump were instructed to be carried in a diplomatic bag, a practice that shields them from police or customs search, so they are considered confidential. This means that the hacker may have just shared document “bombs” that disclose classified information about the Mexican government, or more. As the documents are high in number, they have not been evaluated thoroughly just yet.

The hacker’s move to publish the exfiltrated data has the potential to put people to risk, so it was definitely not an utterly ethical move. However, the Mexican embassy failed twice, once by leaving such a critical database on an unprotected server, and secondly when they failed to respond to the hacker. This is indicative of a complete lack of responsibility, accountability, and competence of the people who are in charge of the embassy’s IT and communications, and so the blame is on them really.

Do you find the hacker’s move completely justified or way too vindictive? Let us know where you stand in the comments section below, and don’t forget to check our socials on Facebook and Twitter for more news stories like this one.