Cyber Incident Victim: Dirección Nacional de Aviación Civil e Infraestructura Aeronáutica
Date:
Mar 2025
Location:
Uruguay
Summary
The websiteof the Dirección Nacional de Aviación Civil e Infraestructura Aeronáutica was defaced, displaying a photograph of President Yamandú Orsi alongside his mobile phone number and a statement claiming access to all addresses, SGSP police records, secrets and dossiers of politicians and public officials. The message, signed with the tags LaPampaLeaks, BogotaLeaks and Uruguayo1337, denounced progressivism, political corruption and mafias, and included an image of an Agesic director. The attackers said they would make those responsible pay for their actions against Uruguay, and the defacement coincided with the anniversary ceremony of the Uruguayan Air Force that the president was scheduled to attend.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 3 actors | Available to members | Available to members |
Description
On March 17, 2025, the website of the Dirección Nacional de Aviación Civil e Infraestructura Aeronáutica (Dinacia) was compromised by unidentified attackers who replaced its normal content with a digital plaque. The plaque displayed a photograph of President Yamandú Orsi that originates from the Ministry of the Interior and is stored within the police SGSP system, accompanied by the president’s personal mobile phone number. Alongside the image and number, the attackers posted a lengthy message written in capital letters that denounced progressivism, political corruption, and alleged mafias, while also criticizing the influence of the 2030 Agenda and the World Economic Forum. The message asserted that the perpetrators possessed access to “all addresses, records SGSP, secrets and dossiers of every politician and public official,” claiming they knew the identities and locations of these individuals and would make them pay for their actions against Uruguay. A second photograph, showing a director of the Agency for Electronic Government and the Information and Knowledge Society (Agesic), was also included on the plaque. The plaque bore the signature “LaPampaLeaks & BogotaLeaks & Uruguayo1337,” indicating the attackers’ self‑identified moniker. The intrusion took place on the anniversary of the Uruguayan Air Force, a date on which President Orsi was scheduled to attend a ceremony at the General Command of the Armed Forces.
Following the defacement, the public exposure of Orsi’s telephone number and the accompanying threat to release sensitive personal and official data prompted immediate concern from the president himself, who described the incident as a matter that worries him and referred specifically to the hack that had filtered his cell number. The message’s claim of access to the SGSP database, which contains addresses, police records and other confidential information, raised alarms about the potential compromise of governmental security systems and the privacy of numerous public officials. Although the article does not detail any technical mitigation steps taken by Dinacia or related agencies, the public statement from Orsi underscored the growing anxiety over cybersecurity threats facing state institutions in Uruguay. The attackers’ reference to the anniversarial Air Force event and the planned presidential attendance suggested a timed effort to maximize visibility and symbolic impact. No further official responses, such as arrests, forensic investigations, or service restorations, are described in the source material. The incident remains noted for its combination of personal data disclosure, ideological messaging, and the invocation of leaked‑data monikers from other regional campaigns.