Instituto Profesional de Chile

We noticed a concerning data leak originating from the Instituto Profesional de Chile, a significant educational institution. The breach, discovered on September 28, 2025, exposed a substantial volume of personal information, impacting over 174,000 individuals. What struck us immediately was the inclusion of both MD5 and bcrypt hashed passwords, suggesting a potential mix of older and newer security practices within their systems, which could complicate remediation efforts.

The breach, classified as a database compromise, appears to have occurred prior to its public disclosure. The dataset, containing 174,013 unique records, was subsequently disseminated via a Telegram channel. The exposed data types include Email Address, Password Hash, First Name, and Last Name. The presence of both MD5 and bcrypt hashes is particularly noteworthy, as MD5 is considered cryptographically broken and easily reversible, while bcrypt, though more robust, still requires careful handling and rotation. The source structure of the leak points to a direct exfiltration from a database, likely through a vulnerability or credential compromise. The leak locations, as observed, are primarily within the Telegram platform, indicating a deliberate act of public disclosure by the threat actor.

While specific news coverage directly linking this incident to major outlets is limited at this time, the nature of the compromised entity – an educational institution – often draws attention from data privacy advocates and cybersecurity researchers. Similar breaches involving educational platforms have been documented globally, frequently highlighting the vulnerability of student and staff data to credential stuffing attacks and phishing campaigns. Further OSINT investigation into the Telegram channel and associated threat actor groups may reveal broader campaign patterns or connections to other compromised entities.