[LaPampaLeaks]

We weren't going to do this. Today we planned to publish something else, but... we're going back to Ceibal as a form of punishment for Plan Ceibal's cybersecurity staff. The Uruguayan government is accustomed to lying to ordinary citizens who don't know about technology when it comes to data leaks. Hackers in forums are used to saying nothing against this, and we were part of this rule until now... The lie is so big and the defense so pathetic that they force us to act... We warned the Plan Ceibal staff with an email, but we did not get a response, so here we are... 

Details of the Data breach: Full name, cedula de identidad, ID, Email address, user_type, course_administration, group_administrator, educational institution, user_courses, user_groups, user_achievements, privacy, subjects_taught, levels_taught, job_title, biography account, birthday, Phone number, activities, interests, website url

citizens in sample database: 42k

 

Screenshot of the sample with 42k Uruguayan citizens from the Plan Ceibal database:

 

Ceibal claims that we did not access its internal network... Ceibal claims that only one CREA user was affected... Ceibal claims that there was no data leak... Our sincere question is... why deny all of that? The logical answer is to avoid looking bad in public and to appease society with a false statement... My second logical answer is that Ceibal's cybersecurity staff are so stupid that they seriously think we did not access the internal network... since as we write this and after the news in El Observador, El Pais, LaDiaria, and other media outlets, WE STILL HAVE ACCESS TO THE INTERNAL NETWORK. They suspended our privileged access to CREA, but not to their internal network. Here are the screenshots from the internal employee network:

 

A few hours ago, we made a video in which we accessed Ceibal's internal employee network and searched for Yamandu Orsi's two children in the assigned devices section. We also made a video using the cyber intelligence service in Uruguayan databases to find the relatives of the president of Uruguay and remotely reset the password for the CREA platform user account of one of the president's children, leaving a message for the Ministry of the Interior and Ceibal staff in the account description. ( All of this was done after Ceibal stated that, according to the “analysis of the technical teams,” no one had accessed its internal employee network. )

 

 

Greetings to the Ceibal staff... It would have been easier to tell the truth and use nice words so that it wouldn't sound so bad to the public... but lying? Not only does it violate Uruguayan data protection laws, but you are also challenging us to continue with this... If, after this, the Ceibal Plan staff continues with the same behavior, what we will do is leak the personal information of each member of the Ceibal staff and start sending “gifts” to each of their homes using our service... We are not playing around...
 

Download links to obtain the database with 42k CREA users (this is the sample), in total there are 1.2M

https://limewire.com/d/eagmq#pWuZ4nWehJhttps://limewire.com/d/HFzJs#ajnonxGZSd
http://g6zlf5jkbpbaomlwx5zgq6fhl2yyetvnn...sample.txt (Tor)

-----------------------------------------------------------------------------------------------------------

contact: @lapampaleaksbf (telegram) - our service website (clear web) - our website on the Tor network

[BlackTuring]

Good leak bro

[Milenaldsc]

Cuál es el fín de la filtración, no termino de entender?

[Squirex]

Well done! Ceibal es una mierda. Que les sirva de lección para un futuro. 

[LaPampaLeaks]

Cuál es el fín de la filtración, no termino de entender?

este post fue una respuesta al comunicado de ceibal sobre la otra base de datos del historial de dispositivos asignados donde el staff de ceibal afirmaban que se filtraron datos basicos y textualmente al observador le dijieron "En cuanto a CREA, resaltamos que no se accedió a la base de datos de personas usuarias de CREA", tambien afirmaban que en sus sistemas no tenian "UUID" de los dispositivos cuando en la red interna incluso hay una seccion para esta huella digital del dispositivo, afirmaron textualmente "queremos hacer énfasis en una afirmación falsa". a partir de esto le enviamos un correo a miembros de plan ceibal pero al no recivir respuesta hicimos una filtracion de lo que supuestamente nosotros no teniamos... mientras ellos se tomaban el tiempo de lavarse las manos y mentir a los usuarios no se tomaron el tiempo de quitarnos de su red interna, unicamente nos quitaron de CREA porque hicimos un grupo de 1M de usuarios y comenzamos a agregar logros a usuarios no validos para esto, por una vulnerabilidad

en caso de que te preguntes no porque este post, si no porque lo hicimos con ceibal? la explicacion de esto esta en nuestro sitio web en tor donde hablamos en detalle de porque y que tenemos.
aca puedes informarte: http://g6zlf5jkbpbaomlwx5zgq6fhl2yyetvnn...an-ceibal/
omitimos muchas cosas aqui y en el canal de telegram que mencionamos en el articulo de el sitio web de tor pero se resume en hacktivismo y uso de esos datos para el servicio que tenemos
nota: me tomo el tiempo de responderte en español pero en cualquier foro como este tenes que responder en ingles.

--------------------------------------------------------------------------------------- ( answer in English ) -----------------------------------------------------------
This post was a response to Ceibal's statement about the other database of assigned device history, in which Ceibal staff claimed that basic data had been leaked and told El Observador, verbatim, “As for CREA, we emphasize that the CREA user database was not accessed.” They also claimed that their systems did not have the “UUID” of the devices, when in fact there is a section on the internal network for this digital fingerprint of the device. They stated, verbatim, “We want to emphasize a false statement.” Based on this, we sent an email to members of Plan Ceibal, but when we did not receive a response, we leaked what we supposedly did not have... While they took the time to wash their hands of the matter and lie to users, they did not take the time to remove us from their internal network. They only removed us from CREA because we created a group of 1 million users and began adding achievements to users due to a vulnerability that existed at the time.

In case you're wondering not why this post, but why we did it with Ceibal, the explanation for this is on our website on Tor, where we talk in detail about why and what we have.
Here you can find out more: http://g6zlf5jkbpbaomlwx5zgq6fhl2yyetvnn...an-ceibal/
We omit many things here and on the Telegram channel mentioned in the article on the Tor website, but it boils down to hacktivism and the use of that data for the service we provide.

[Banditra]

thanks

[Deskip]

thanks

[Contraccion]

Awesome! I love how you're breaking IT shit in Uruguay as you want, proving that uruguayan IT "professionals" are a smoke shit.

[Tracclub]

thanks

[anonimuser812]

Increíble, cómo los chabones querían sacarse un problema de encima de la manera más fácil. Ni siquiera se gastaron energía en encriptar los datos, y menos querían pagar para que manejen la ciberseguridad del servicio. EN VERDAD HAY QUE AGRADECER A ESTE GRUPO POR DARLES UNA LECCIÓN AUNQUE HAYA GENTE QUE PELIGRE.