PII Exposure Summary | Ecuador
ODINT's Ecuador cyber tour maps exposed government infrastructure, tax APIs, shared CMS credentials, public GitLab code, and 26.25 GB of evidence.
- Record
- INV-535556
- Status
- published
- Assets
- 0
- Documents
- 0
- Map
- Not included
PII Exposure Summary
Citizen PII Exposure - WordPress REST API
Summary
Citizen personal data was publicly accessible without authentication across multiple WordPress comment datasets.
ARCOTEL (Telecom Regulator) — 5,000 Comments
Citizens post IMEI numbers, cédula (national ID), phone numbers, and full names in public comments requesting IMEI unlocking and device registration.
| Data Type | Count |
|---|---|
| Cédula (national ID) numbers | 364 |
| IMEI numbers | 93 |
| Phone numbers | 328 |
| Email addresses | 57 |
| Citizen names | 2,336 |
| Cédula-name pairs | 410 |
Inclusion.gob.ec (Social Inclusion Ministry) — 4,549 Comments
Citizens post personal data in comments requesting social services (Bono de Desarrollo Humano, disability assistance, etc.).
| Data Type | Count |
|---|---|
| Cédula (national ID) numbers | 327 |
| Phone numbers | 328 |
| Email addresses | 54 |
| Citizen names | 1,960 |
| Cédula-name pairs | 355 |
Combined Totals
| Data Type | Total |
|---|---|
| Cédulas (national IDs) | 691 |
| Phone numbers | 656 |
| IMEI numbers | 93 |
| Email addresses | 111 |
| Citizen names | 4,296 |
| Cédula-name deanonymization pairs | 765 |
Government Employee Emails — 659 Unique
| Top Domains | Count |
|---|---|
| msp.gob.ec (Health Ministry) | 142 |
| espoch.edu.ec (ESPOCH University) | 133 |
| iess.gob.ec (Social Security) | 67 |
| arcotel.gob.ec (Telecom) | 66 |
| uta.edu.ec (Technical University) | 38 |
| cpccs.gob.ec (Citizens Participation) | 25 |
| bce.ec (Central Bank) | 27 |
| cfn.fin.ec (National Finance) | 19 |
| celec.gob.ec (State Electric) | 9 |
Impact
- Ecuador's national ID (cédula) is a 10-digit number used for ALL government services
- Pairing cédulas with names enables identity theft and social engineering
- IMEI numbers can be used to track mobile devices
- All data is accessible via unauthenticated HTTP GET requests to WordPress REST API
- Neither ARCOTEL nor Inclusion.gob.ec have disabled public comment access
- The WordPress API returns comments with full author names by default
Additional PII Noted
- ARCOTEL meeting password published in WordPress post:
wUZNtk8uj53 - ECU911 internal IPs in post content:
10.121.6.234,10.121.7.112,192.168.1.232,192.168.2.144