08-08-26, 01:18 PM
# A Mexican CFDI Tax Platform's Entire Database Is Sitting on a Public S3 Bucket — Full Breakdown
A Mexican e-invoicing company called **itimbre.com** has its complete production database — customers, tax certificates, private keys, payments, bank accounts — exposed on a publicly accessible Amazon S3 bucket in two archive files. No credentials required. Here is everything: what this platform is, what was in the files, how to download them, how to unpack them, and what exactly is inside.
---
## 1. What is this thing?
**itimbre.com** — a Mexican company that sells **CFDI electronic invoice stamping (timbrado) services**.
In Mexico, every business that issues invoices must have its receipts validated and "stamped" with a digital seal by SAT (Servicio de Administración Tributaria — the Mexican tax authority) through authorized service providers. This platform stamps CFDI invoices for client companies and charges per stamp. It's an e-invoicing SaaS with a payment scheme, an MLM reseller network, and direct SAT integration.
That kind of business stores **other companies' tax certificates and private keys** — and the entire database behind it is sitting on an open S3 bucket.
---
## 2. What was exposed? (two files)
| File | Size | Description |
|---|---|---|
| `itimbre_core_db.tar.gz.enc` | 1.72 GB | OpenSSL-encrypted tar.gz containing 2 PostgreSQL dumps |
| `itimbre_split.zip` | 1.28 GB | Password-protected ZIP, 34 files, ~15 GB uncompressed |
---
## 3. Download
Both files are plain HTTP downloads — no authentication, no signed URLs:
```
https://storage.s3.amazonaws.com/itimbre...tar.gz.enc
https://storage.s3.amazonaws.com/itimbre_split.zip
```
```bash
# file 1
curl -o itimbre_core_db.tar.gz.enc https://storage.s3.amazonaws.com/itimbre...tar.gz.enc
# file 2
curl -o itimbre_split.zip https://storage.s3.amazonaws.com/itimbre_split.zip
```
---
## 4. The passwords
| File | Password | Encryption |
|---|---|---|
| `itimbre_core_db.tar.gz.enc` | `P3nt3st!timbre_2026` | OpenSSL AES-256-CBC + PBKDF2 |
| `itimbre_split.zip` | `P3nt3st!timbre_2026` (same packaging run — very likely, verify below) | ZIP traditional encryption |
The password is a pentest-flavored string (`P3nt3st!timbre_2026`) — the "protection" on an entire customer database.
---
## 5. How to unpack
### File 1 — `itimbre_core_db.tar.gz.enc` (macOS / Linux)
```bash
openssl enc -d -aes-256-cbc -pass pass:"P3nt3st!timbre_2026" -pbkdf2 \
-in itimbre_core_db.tar.gz.enc | tar xzf -
```
Result:
- `master_itimbre_v2.dump` — 297 MB (PostgreSQL 13.11 dump, DB `master_itimbre`)
- `admin_itimbre.dump` — 1.4 GB (PostgreSQL 13.11 dump, DB `admin_itimbre`)
Windows: install 7-Zip, open the `.enc` file, enter `P3nt3st!timbre_2026`.
### File 2 — `itimbre_split.zip`
```bash
unzip -P "P3nt3st!timbre_2026" itimbre_split.zip
# or: 7z x -p"P3nt3st!timbre_2026" itimbre_split.zip
```
Verify the password in 5 seconds (the zip central directory tells us file sizes; `07_bancos.csv` is only 148 bytes):
```bash
unzip -P "P3nt3st!timbre_2026" -o itimbre_split.zip 07_bancos.csv && cat 07_bancos.csv
```
### Import the databases (optional, to browse the data)
```bash
pg_restore -d master_itimbre master_itimbre_v2.dump
pg_restore -d admin_itimbre admin_itimbre.dump
# or from the split zip:
zcat 08_master_itimbre.sql.gz | psql -d master_itimbre
zcat 09_admin_itimbre.sql.gz | psql -d admin_itimbre
```
---
## 6. What's inside — the full inventory
### `itimbre_core_db.tar.gz.enc` → 2 PostgreSQL databases
**`master_itimbre`** (39 tables) — the customer-facing platform:
- **`contacto` — 4,810 customer accounts** with names, emails, phone/mobile numbers, passwords, subscription data, login timestamps. Includes 30 accounts on the platform's own domain `@itimbre.com` (staff: `[email protected]`, `[email protected]`, `[email protected]`, plus named accounts such as `anosse@`, `asaenz@`, `asanchez@`, `asotelo@`, `bgonzalez@`, `ecortez@`, `gperales@`, `hsaenz@`, `isanchez@`, `ivillasenor@`, `jesusc@`, `lagarcia@`, `lburgos@`, `maparicio@`, `mmachuca@`, `osmanybg@`, `rolvera@`, `testrada@`…)
- **`empresa` — client companies, each with RFC (Mexican tax ID), CSD certificate (`nocertificado`, `certificado`) and the certificate **private key (`pv_key`) + private-key password (`pv_key_pass`)** — approximately **2,078 complete CSD private-key sets**. These are legally binding electronic seals: they can be used to sign and stamp CFDI invoices in the name of those companies
- `datos_facturacion` — billing data: RFC, street, `colonia`, `municipio`, state, `cp` postal code (full Mexican address format)
- `cfdi`, `sat_cfdi`, `sat_catalogos` — issued invoices and SAT catalogs
- `users_fiel` — FIEL advanced e-signatures
- `dms_dmsatpaquetes`, `dms_dmsatsolicitudes` — SAT DMS request logs
- `servicios_contratados`, `software_cuentas`, `tipo_comprobante` — subscribed services and software accounts
- `orden_compra`, `po_*` — purchase orders
- `pac_confirmacion`, `payment_scheme_stamps` — PAC confirmations, stamp-quota payments
- `password_history`, `login_emails`, `login_tries`, `users_log` — credential history and login trails
**`admin_itimbre`** (65 tables) — the operator/admin side:
- `users`, `profile`, `modules`, `niveles_soporte` — admin staff accounts
- `cuentas`, `cuentas_bancarias`, `cuentas_history` — customer accounts and **bank account details**
- `cfdi_cuentas`, `cfdis_recurrentes`, `emisores` — invoicing setup and issuers
- `pagos_recibidos`, `pagos_detalles`, `pagos_timbres`, `charges` — full payment records
- `commissions_direct_details`, `commissions_network_details`, `network_schemas` — the MLM reseller commission network
- `manifesto`, `nomenclators` — customs manifests
- `fuerza_de_ventas`, `sellers` — the sales force
- `addenda_calimax_sucursales` — addenda for **Calimax**, a Mexican supermarket chain
- `respaldos_programados` — scheduled backup configuration
- **2,191 paying accounts**
### `itimbre_split.zip` → 34 files, all password-protected
| File | Size | Contents |
|---|---|---|
| `01_fiel_keys.csv` | 8 KB | FIEL e-signature keys |
| `02_emisores_csd.csv` | 913 KB | Issuers' CSD certificates |
| `03_cuentas_creds.csv` | 522 KB | **Account credentials** |
| `04_users.csv` | 15 KB | Users |
| `05_pagos_recibidos.csv` | 3.5 MB | Payments received |
| `06_pagos_timbres.csv` | 7 KB | Stamp payments |
| `07_bancos.csv` | 148 B | Banks |
| `08_master_itimbre.sql.gz` | 298 MB | Full master DB SQL dump |
| `09_admin_itimbre.sql.gz` | 1.43 GB | Full admin DB SQL dump |
| `11_pac_202501_cfdis.csv.gz` | 991 MB | PAC-stamped invoices, Jan 2025 |
| `11_pac_202601_cfdis.csv.gz` | 1.02 GB | PAC-stamped invoices, Jan 2026 |
| `11_pac_202501_emisores.csv.gz` | 18 KB | Issuers, Jan 2025 |
| `11_pac_202601_emisores.csv.gz` | 18 KB | Issuers, Jan 2026 |
| `10_cinv_*.csv.gz` (20 files) | 324 B – 2.84 GB | Per-company invoice/receipt/client exports for 6 Mexican taxpayers (RFC-shaped names: `bca180903g7a1`, `bego841019du01`, `pro020807jb7`, `femcorio1_5`, `generadoresdeenergia1_6`, **`foxconn1_6`**) |
The `foxconn1_6` export corresponds to **Foxconn's Mexican operations**; `generadoresdeenergia1_6` is an energy-generation company. Total uncompressed: **~15 GB**.
---
## 7. Why this matters
- **2,078 CSD certificate private keys + passwords** — legally binding electronic seals; whoever holds them can impersonate those companies in front of the Mexican tax authority
- **4,810 customer accounts with phone numbers + credentials** — ready-made target lists
- **Bank account details, payment records, commission structure** — full financial picture of a payment-processing business
- **Staff accounts on `@itimbre.com`** — the company's own admin surface
- The "protection" was a single short password (`P3nt3st!timbre_2026`), printed in plaintext in the packaging shell session
A Mexican e-invoicing company called **itimbre.com** has its complete production database — customers, tax certificates, private keys, payments, bank accounts — exposed on a publicly accessible Amazon S3 bucket in two archive files. No credentials required. Here is everything: what this platform is, what was in the files, how to download them, how to unpack them, and what exactly is inside.
---
## 1. What is this thing?
**itimbre.com** — a Mexican company that sells **CFDI electronic invoice stamping (timbrado) services**.
In Mexico, every business that issues invoices must have its receipts validated and "stamped" with a digital seal by SAT (Servicio de Administración Tributaria — the Mexican tax authority) through authorized service providers. This platform stamps CFDI invoices for client companies and charges per stamp. It's an e-invoicing SaaS with a payment scheme, an MLM reseller network, and direct SAT integration.
That kind of business stores **other companies' tax certificates and private keys** — and the entire database behind it is sitting on an open S3 bucket.
---
## 2. What was exposed? (two files)
| File | Size | Description |
|---|---|---|
| `itimbre_core_db.tar.gz.enc` | 1.72 GB | OpenSSL-encrypted tar.gz containing 2 PostgreSQL dumps |
| `itimbre_split.zip` | 1.28 GB | Password-protected ZIP, 34 files, ~15 GB uncompressed |
---
## 3. Download
Both files are plain HTTP downloads — no authentication, no signed URLs:
```
https://storage.s3.amazonaws.com/itimbre...tar.gz.enc
https://storage.s3.amazonaws.com/itimbre_split.zip
```
```bash
# file 1
curl -o itimbre_core_db.tar.gz.enc https://storage.s3.amazonaws.com/itimbre...tar.gz.enc
# file 2
curl -o itimbre_split.zip https://storage.s3.amazonaws.com/itimbre_split.zip
```
---
## 4. The passwords
| File | Password | Encryption |
|---|---|---|
| `itimbre_core_db.tar.gz.enc` | `P3nt3st!timbre_2026` | OpenSSL AES-256-CBC + PBKDF2 |
| `itimbre_split.zip` | `P3nt3st!timbre_2026` (same packaging run — very likely, verify below) | ZIP traditional encryption |
The password is a pentest-flavored string (`P3nt3st!timbre_2026`) — the "protection" on an entire customer database.
---
## 5. How to unpack
### File 1 — `itimbre_core_db.tar.gz.enc` (macOS / Linux)
```bash
openssl enc -d -aes-256-cbc -pass pass:"P3nt3st!timbre_2026" -pbkdf2 \
-in itimbre_core_db.tar.gz.enc | tar xzf -
```
Result:
- `master_itimbre_v2.dump` — 297 MB (PostgreSQL 13.11 dump, DB `master_itimbre`)
- `admin_itimbre.dump` — 1.4 GB (PostgreSQL 13.11 dump, DB `admin_itimbre`)
Windows: install 7-Zip, open the `.enc` file, enter `P3nt3st!timbre_2026`.
### File 2 — `itimbre_split.zip`
```bash
unzip -P "P3nt3st!timbre_2026" itimbre_split.zip
# or: 7z x -p"P3nt3st!timbre_2026" itimbre_split.zip
```
Verify the password in 5 seconds (the zip central directory tells us file sizes; `07_bancos.csv` is only 148 bytes):
```bash
unzip -P "P3nt3st!timbre_2026" -o itimbre_split.zip 07_bancos.csv && cat 07_bancos.csv
```
### Import the databases (optional, to browse the data)
```bash
pg_restore -d master_itimbre master_itimbre_v2.dump
pg_restore -d admin_itimbre admin_itimbre.dump
# or from the split zip:
zcat 08_master_itimbre.sql.gz | psql -d master_itimbre
zcat 09_admin_itimbre.sql.gz | psql -d admin_itimbre
```
---
## 6. What's inside — the full inventory
### `itimbre_core_db.tar.gz.enc` → 2 PostgreSQL databases
**`master_itimbre`** (39 tables) — the customer-facing platform:
- **`contacto` — 4,810 customer accounts** with names, emails, phone/mobile numbers, passwords, subscription data, login timestamps. Includes 30 accounts on the platform's own domain `@itimbre.com` (staff: `[email protected]`, `[email protected]`, `[email protected]`, plus named accounts such as `anosse@`, `asaenz@`, `asanchez@`, `asotelo@`, `bgonzalez@`, `ecortez@`, `gperales@`, `hsaenz@`, `isanchez@`, `ivillasenor@`, `jesusc@`, `lagarcia@`, `lburgos@`, `maparicio@`, `mmachuca@`, `osmanybg@`, `rolvera@`, `testrada@`…)
- **`empresa` — client companies, each with RFC (Mexican tax ID), CSD certificate (`nocertificado`, `certificado`) and the certificate **private key (`pv_key`) + private-key password (`pv_key_pass`)** — approximately **2,078 complete CSD private-key sets**. These are legally binding electronic seals: they can be used to sign and stamp CFDI invoices in the name of those companies
- `datos_facturacion` — billing data: RFC, street, `colonia`, `municipio`, state, `cp` postal code (full Mexican address format)
- `cfdi`, `sat_cfdi`, `sat_catalogos` — issued invoices and SAT catalogs
- `users_fiel` — FIEL advanced e-signatures
- `dms_dmsatpaquetes`, `dms_dmsatsolicitudes` — SAT DMS request logs
- `servicios_contratados`, `software_cuentas`, `tipo_comprobante` — subscribed services and software accounts
- `orden_compra`, `po_*` — purchase orders
- `pac_confirmacion`, `payment_scheme_stamps` — PAC confirmations, stamp-quota payments
- `password_history`, `login_emails`, `login_tries`, `users_log` — credential history and login trails
**`admin_itimbre`** (65 tables) — the operator/admin side:
- `users`, `profile`, `modules`, `niveles_soporte` — admin staff accounts
- `cuentas`, `cuentas_bancarias`, `cuentas_history` — customer accounts and **bank account details**
- `cfdi_cuentas`, `cfdis_recurrentes`, `emisores` — invoicing setup and issuers
- `pagos_recibidos`, `pagos_detalles`, `pagos_timbres`, `charges` — full payment records
- `commissions_direct_details`, `commissions_network_details`, `network_schemas` — the MLM reseller commission network
- `manifesto`, `nomenclators` — customs manifests
- `fuerza_de_ventas`, `sellers` — the sales force
- `addenda_calimax_sucursales` — addenda for **Calimax**, a Mexican supermarket chain
- `respaldos_programados` — scheduled backup configuration
- **2,191 paying accounts**
### `itimbre_split.zip` → 34 files, all password-protected
| File | Size | Contents |
|---|---|---|
| `01_fiel_keys.csv` | 8 KB | FIEL e-signature keys |
| `02_emisores_csd.csv` | 913 KB | Issuers' CSD certificates |
| `03_cuentas_creds.csv` | 522 KB | **Account credentials** |
| `04_users.csv` | 15 KB | Users |
| `05_pagos_recibidos.csv` | 3.5 MB | Payments received |
| `06_pagos_timbres.csv` | 7 KB | Stamp payments |
| `07_bancos.csv` | 148 B | Banks |
| `08_master_itimbre.sql.gz` | 298 MB | Full master DB SQL dump |
| `09_admin_itimbre.sql.gz` | 1.43 GB | Full admin DB SQL dump |
| `11_pac_202501_cfdis.csv.gz` | 991 MB | PAC-stamped invoices, Jan 2025 |
| `11_pac_202601_cfdis.csv.gz` | 1.02 GB | PAC-stamped invoices, Jan 2026 |
| `11_pac_202501_emisores.csv.gz` | 18 KB | Issuers, Jan 2025 |
| `11_pac_202601_emisores.csv.gz` | 18 KB | Issuers, Jan 2026 |
| `10_cinv_*.csv.gz` (20 files) | 324 B – 2.84 GB | Per-company invoice/receipt/client exports for 6 Mexican taxpayers (RFC-shaped names: `bca180903g7a1`, `bego841019du01`, `pro020807jb7`, `femcorio1_5`, `generadoresdeenergia1_6`, **`foxconn1_6`**) |
The `foxconn1_6` export corresponds to **Foxconn's Mexican operations**; `generadoresdeenergia1_6` is an energy-generation company. Total uncompressed: **~15 GB**.
---
## 7. Why this matters
- **2,078 CSD certificate private keys + passwords** — legally binding electronic seals; whoever holds them can impersonate those companies in front of the Mexican tax authority
- **4,810 customer accounts with phone numbers + credentials** — ready-made target lists
- **Bank account details, payment records, commission structure** — full financial picture of a payment-processing business
- **Staff accounts on `@itimbre.com`** — the company's own admin surface
- The "protection" was a single short password (`P3nt3st!timbre_2026`), printed in plaintext in the packaging shell session
