Cyber Threat Actor: ChatLeaks

ChatLeaks is the aliasused by an individual or group that has been linked to the disclosure of private communications involving Puerto Rican officials. The actor is associated with the location of Puerto Rico, although specific details about their base of operations are not publicly confirmed. No other aliases have been reported in open sources for this threat actor. The name ChatLeaks appears in connection with the 2019 leak of a governor’s private chat group. This identifier is the primary reference point for tracking the actor’s activity.

On July 16, 2019, ChatLeaks released a large set of private chat messages from the governor of Puerto Rico on the messaging platform Telegram. The disclosed material amounted to nearly nine hundred pages and contained derogatory and homophobic remarks aimed at public figures such as Ricky Martin and Melissa Mark‑Viverito. Media outlets labeled the incident “Rickygate” and highlighted the offensive nature of the exchanges. The publication triggered widespread protests across Puerto Rico as citizens reacted to the perceived disrespect and bias expressed in the chats. The leak demonstrated the actor’s ability to obtain and disseminate sensitive internal communications through a widely used messaging service.

No additional campaigns or operations have been publicly attributed to ChatLeaks beyond the 2019 Telegram leak. Consequently, the actor’s known targeting appears limited to a single political figure’s private communications in Puerto Rico. There is no publicly available information linking ChatLeaks to any state sponsor, criminal consortium, or financial motive. The lack of further reported activity means that assessments of the actor’s typical tactics, tools, or strategic objectives remain speculative and therefore omitted from this profile. The Rickygate incident stands as the sole documented example of ChatLeaks’ activity in open source reporting.