Your Mexican Government Login May Be Cracked: The INAH Breach Hit 296 Users

HEROIC confirmed 296 records from Instituto Nacional de Antropología e Historia appearing on dark web channels on February 27, 2025, exposing email addresses, usernames, and MD5 password hashes from Mexico's federal cultural heritage institution at inah.gob.mx. The dataset is small but dangerous, because MD5 hashes of even modestly weak passwords fall to rainbow tables in minutes.

Why This INAH Database Breach Is Dangerous

MD5 should not be used to store passwords, and yet this is how INAH stored them. That means the 296 hashes in this leak are closer to plaintext than to real cryptographic protection. Anyone reusing their INAH password elsewhere, including Mexican government portals, email, or cloud services, should assume their credential is already known to attackers.

What Was Exposed in Instituto Nacional de Antropología e Historia

• 296 INAH user records from the institutional database
• Email addresses tied to researchers, staff, and registered users
• Usernames used for institutional logins
• MD5 password hashes that are effectively crackable

Why This Matters

A government database holds more than just usernames. It holds keys to systems that often connect to national archives, archaeology data, and research funding tools. A successfully cracked INAH credential can pivot into other gob.mx platforms if passwords were reused, which is common among long-tenured staff. The small record count does not reduce the impact, it concentrates it on high-value accounts.

How a Government Database Breach Like This Works

Government portals often combine legacy PHP codebases, outdated CMS installs, and inconsistent patching. Attackers probe for SQL injection in search forms, login endpoints, or content management modules, and once inside, they pull the user table. The uniform structure of the INAH dump points to a single direct export rather than an ongoing compromise.

Check If You Are Affected

If you have ever held an INAH account, search HEROIC's 400B+ record breach database to see whether your credential is in this leak. Finding a match should prompt you to rotate that password anywhere it was reused and ask your IT team to force MFA on other gob.mx tenants you can access.