Hostinger Colombia full leak: 4.4M records, 58K ID photos, 61 domains

DozerMx · 10-07-26, 10:55 PM

DISCLOSURE

Compromised system: Hostinger shared hosting

Properties: certifica.com.co / guiapix.com / colombianslens.com + 58 additional domains

Total domains: 61

Date: July 2026

EXTRACTED DATA

Databases (7):

- u530539221_certificalo: 75 tables, 1,917,362 records
- u530539221_guiapix: 69 tables, 1,008,117 records
- u530539221_colombians_len: 21 tables, 1,161 records
- u530539221_shanfle: 12 tables, 1,135 records
- u530539221_bdafo: 7 tables, 88 records
- u530539221_damas: 12 tables, 183 records
- u530539221_prinox: 6 tables, 223 records
- SECOP II: 1 table, 1,492,089 records

Total DB records: 4,418,729

Photos:

- fotosCarnetizados.tar.gz: 4.0 GB, 57,977 ID card

photos

- Fotos_Newport.tar.gz: 2.6 GB, 446 Newport photos

Total photos: 58,423

Mobile apps (5):

- guiapixAPK.apk, YoRecojoAPK.apk, HecoApp1.apk, HecoApp2.apk

- Certifica_app_release.aab

- guiapix_app_source.tar.gz (4.4 MB, Ionic)

Exported files: 72 CSVs/JSONs

Total size: 6.9 GB

DATA INCLUDED

- ID cards: 53,306 records with name, ID number, photo, phone, school, grade
- SECOP II emails: 1,492,089 contacts with name, tax ID, phone, email, address, legal representative
- APP users: 10,000+ with name, phone, email, password, photo, push token
- Companies: 96 entities with tax ID, address, contact, logo
- Projects: 226 projects with card and payment configuration
- GPS geolocation: 10,000+ historical records
- VCard: 233 digital cards with personal data and social networks
- Loyalty: points, balances, redemptions, levels
- Payments: concepts, students, receipts, transactions
- Visitors: registration with photo, ID, license plate
- Internal messaging: 2,028 messages
- Notifications: 243 records

SAMPLE

A sample with real data (5.2 MB) is included as proof of authenticity:
- 10 real ID card photos
- SQL records from carnetizadosTodos, SECOP II, teachers, students, payments, messages, visitors
- CSVs of ID cards, SECOP II emails, companies
- JSONs of ID cards, emails, projects, companies
- App source file listing

WARNING

This data was obtained due to negligence in the security of the compromised systems.

Nothing has been leaked yet.

If we do not receive a public response from those responsible

we will proceed to release all data in a public thread:

- 4,418,729 database records

- 58,423 ID card photos

- Application source code

Responsibility for the exposure of this data lies solely with those who

operated these systems without the minimum security measures in place.

@DozerMx

janbv124 · 26-07-26, 03:18 PM

Gokcg

abonasrpy · (This post was last modified: 27-07-26, 10:29 AM by abonasrpy.)

(10-07-26, 10:55 PM)DozerMx Wrote:
DISCLOSURE

Compromised system: Hostinger shared hosting

Properties: certifica.com.co / guiapix.com / colombianslens.com + 58 additional domains

Total domains: 61

Date: July 2026

EXTRACTED DATA

Databases (7):

- u530539221_certificalo: 75 tables, 1,917,362 records - u530539221_guiapix: 69 tables, 1,008,117 records - u530539221_colombians_len: 21 tables, 1,161 records - u530539221_shanfle: 12 tables, 1,135 records - u530539221_bdafo: 7 tables, 88 records - u530539221_damas: 12 tables, 183 records - u530539221_prinox: 6 tables, 223 records - SECOP II: 1 table, 1,492,089 records
Total DB records: 4,418,729

Photos:

- fotosCarnetizados.tar.gz: 4.0 GB, 57,977 ID card

photos

- Fotos_Newport.tar.gz: 2.6 GB, 446 Newport photos

Total photos: 58,423

Mobile apps (5):

- guiapixAPK.apk, YoRecojoAPK.apk, HecoApp1.apk, HecoApp2.apk

- Certifica_app_release.aab

- guiapix_app_source.tar.gz (4.4 MB, Ionic)

Exported files: 72 CSVs/JSONs

Total size: 6.9 GB

DATA INCLUDED

- ID cards: 53,306 records with name, ID number, photo, phone, school, grade - SECOP II emails: 1,492,089 contacts with name, tax ID, phone, email, address, legal representative - APP users: 10,000+ with name, phone, email, password, photo, push token - Companies: 96 entities with tax ID, address, contact, logo - Projects: 226 projects with card and payment configuration - GPS geolocation: 10,000+ historical records - VCard: 233 digital cards with personal data and social networks - Loyalty: points, balances, redemptions, levels - Payments: concepts, students, receipts, transactions - Visitors: registration with photo, ID, license plate - Internal messaging: 2,028 messages - Notifications: 243 records
SAMPLE

A sample with real data (5.2 MB) is included as proof of authenticity: - 10 real ID card photos - SQL records from carnetizadosTodos, SECOP II, teachers, students, payments, messages, visitors - CSVs of ID cards, SECOP II emails, companies - JSONs of ID cards, emails, projects, companies - App source file listing
WARNING

This data was obtained due to negligence in the security of the compromised systems.

Nothing has been leaked yet.

If we do not receive a public response from those responsible

we will proceed to release all data in a public thread:

- 4,418,729 database records

- 58,423 ID card photos

- Application source code

Responsibility for the exposure of this data lies solely with those who

operated these systems without the minimum security measures in place.

@DozerMx

nice >>

laoamjad06 · 28-07-26, 04:42 AM

hb nkb ojn pij,

dm23122312 · 22-08-26, 07:03 AM

thansk

22-08-26, 07:19 AM

good bro

honeydutches · 22-08-26, 07:23 AM

(10-07-26, 10:55 PM)DozerMx Wrote:
DISCLOSURE

Compromised system: Hostinger shared hosting

Properties: certifica.com.co / guiapix.com / colombianslens.com + 58 additional domains

Total domains: 61

Date: July 2026

EXTRACTED DATA

Databases (7):

- u530539221_certificalo: 75 tables, 1,917,362 records - u530539221_guiapix: 69 tables, 1,008,117 records - u530539221_colombians_len: 21 tables, 1,161 records - u530539221_shanfle: 12 tables, 1,135 records - u530539221_bdafo: 7 tables, 88 records - u530539221_damas: 12 tables, 183 records - u530539221_prinox: 6 tables, 223 records - SECOP II: 1 table, 1,492,089 records
Total DB records: 4,418,729

Photos:

- fotosCarnetizados.tar.gz: 4.0 GB, 57,977 ID card

photos

- Fotos_Newport.tar.gz: 2.6 GB, 446 Newport photos

Total photos: 58,423

Mobile apps (5):

- guiapixAPK.apk, YoRecojoAPK.apk, HecoApp1.apk, HecoApp2.apk

- Certifica_app_release.aab

- guiapix_app_source.tar.gz (4.4 MB, Ionic)

Exported files: 72 CSVs/JSONs

Total size: 6.9 GB

DATA INCLUDED

- ID cards: 53,306 records with name, ID number, photo, phone, school, grade - SECOP II emails: 1,492,089 contacts with name, tax ID, phone, email, address, legal representative - APP users: 10,000+ with name, phone, email, password, photo, push token - Companies: 96 entities with tax ID, address, contact, logo - Projects: 226 projects with card and payment configuration - GPS geolocation: 10,000+ historical records - VCard: 233 digital cards with personal data and social networks - Loyalty: points, balances, redemptions, levels - Payments: concepts, students, receipts, transactions - Visitors: registration with photo, ID, license plate - Internal messaging: 2,028 messages - Notifications: 243 records
SAMPLE

A sample with real data (5.2 MB) is included as proof of authenticity: - 10 real ID card photos - SQL records from carnetizadosTodos, SECOP II, teachers, students, payments, messages, visitors - CSVs of ID cards, SECOP II emails, companies - JSONs of ID cards, emails, projects, companies - App source file listing
WARNING

This data was obtained due to negligence in the security of the compromised systems.

Nothing has been leaked yet.

If we do not receive a public response from those responsible

we will proceed to release all data in a public thread:

- 4,418,729 database records

- 58,423 ID card photos

- Application source code

Responsibility for the exposure of this data lies solely with those who

operated these systems without the minimum security measures in place.

@DozerMx

dm23122312 · 22-08-26, 11:21 PM

thanks

m4lziin44 · 29-08-26, 11:25 AM

thanklsyouu

monypeny2077 · 07-10-26, 07:02 AM

thanks for sharing a lot