Brinztech Alert: Data from Uruguay’s Office of Planning and Budget (OPP) Leaked by Hacktivist

Dark Web News Analysis: Uruguay’s Office of Planning and Budget Data Leaked by Hacktivist “Lubetkin”

The hacktivist “Lubetkin” has claimed responsibility for a major data breach targeting the Oficina de Planeamiento y Presupuesto (OPP), Uruguay’s central Office of Planning and Budget. The attacker claims to have exfiltrated a wide variety of sensitive data from multiple government ministries and has threatened further leaks. This is a critical national security event, suggesting a deep compromise of government systems. The attacker has explicitly threatened to leak data from the Ministry of Foreign Affairs (mrree.gub.uy) next. The currently exposed data reportedly includes:

• Government Communications: Zoom meeting recordings and other internal communications.
• Financial and Programmatic Data: Payment documents and information on specific government programs like Certuy and “Tacuara incidents.”
• Technical and Security Data: Highly sensitive VPN configurations and data from Agesic (Uruguay’s e-government and information society agency) applications.
• Future Threats: The actor has explicitly threatened to leak data from the Ministry of Foreign Affairs next.

Key Cybersecurity Insights

A politically motivated breach of a central government body, especially one that includes technical configurations and threats of future leaks, is a severe and ongoing crisis.

• A Politically Motivated Attack Designed for Maximum Impact: The attacker’s political statements and the nature of the leak indicate a clear hacktivist agenda. The goal is not just to steal data but to expose and embarrass the Uruguayan government. The explicit threat of future leaks against other ministries is a classic tactic designed to maximize psychological pressure and prolong the crisis.
• Evidence of a Widespread, Multi-Ministry Government Compromise: The fact that data from various ministries, the national e-government agency (Agesic), and specific programs was exfiltrated suggests this is not an isolated breach of a single server. It points to a deep, systemic compromise that may have given the attacker broad access across the Uruguayan government’s network.
• Leaked VPN Configs and Ministry Data Pose a Severe Espionage Risk: The leak of VPN configurations is extremely dangerous. It provides a technical blueprint for other adversaries, such as nation-state actors, to bypass the government’s security and gain persistent access to its internal networks. Combined with the threat to leak Foreign Affairs data, this incident represents a severe and immediate risk of state-sponsored espionage.

Critical Mitigation Strategies

The Government of Uruguay must treat this as an active and ongoing national security incident requiring a coordinated, top-priority response.

• For the Government of Uruguay: Immediately Launch a National-Level Incident Response: This is a national security incident. Uruguay’s national cybersecurity agency (AGESIC) must lead a full-scale investigation to validate the claims, identify the full scope of the multi-agency compromise, and immediately begin a proactive threat hunt for the attacker’s presence across all government networks.
• For All Uruguayan Ministries: Assume Compromise and Harden All Systems: All government bodies, especially the Ministry of Foreign Affairs which was explicitly threatened, must operate under the assumption they are actively being targeted or have already been breached. This requires an urgent review of all security protocols, immediate patching of any vulnerabilities, and a mandatory reset of all privileged credentials.
• For All Government Employees: Be on High Alert for Social Engineering: All government staff must be warned that their internal data and communications may be compromised. They need to be on high alert for sophisticated spear-phishing and social engineering attacks that will use this internal knowledge to appear highly legitimate and trustworthy.

Secure Your Organization with Brinztech As a cybersecurity provider, we can protect your business from the threats discussed here. Contact us to learn more about our services.

Questions or Feedback? For expert advice, use our ‘Ask an Analyst’ feature. For general inquiries or to report this post, please email us: contact@brinztech.com