RENIEC Data Breach: 31,888,743 Records With Names and Birthdays

HEROIC analysts logged the RENIEC data breach, dated May 1, 2023, which exposed 31,888,743 records. Each record lists a first name, a last name, a birthday and gender. No email address and no password appears in the record. To see where you stand, scan your email.

What a Name and a Birthday Allow Together

A full name with a birthday is a common way to confirm identity on the phone or in a message. Someone holding both can sound convincing when posing as a bank, a service provider or an authority, and can aim a scam at a specific person rather than a random one.

The Four Fields in the Record

• First names, which let a caller or sender address a person directly and sound familiar.
• Last names, which complete the name used to look someone up or impersonate them.
• Birthdays, a detail used to confirm identity, and one that cannot be changed.
• Gender, which adds a personal detail that makes a fake message seem tailored.

Where the Risk Shows Up

The leading risk is impersonation: calls, texts and emails that use correct personal details to push someone into sharing more information or paying money. Identity theft attempts also gain from accurate names and birthdays. Because the record holds no passwords, nothing needs to be reset, and watchfulness is the main defense.

How a Database Breach Happens

A database breach means records were taken from one organization's own systems rather than from individual devices. Everything in the record was held in one place, and the exposure applies to everyone whose details were stored there. The record lists only the four fields above.

Does Your Information Appear in the RENIEC Records?

To check, scan your email and see your information. Because the record lists no passwords, there is nothing to reset here; instead, treat unexpected calls, texts and emails that quote your name or birthday with care, and confirm requests through a contact you already trust. This applies to personal and work addresses alike.