Argentinian National Registry of Persons

The Argentinian National Registry of Persons, known as RENAPER, is the government agency responsible for maintaining the country's civil identification system. It issues the national identity document (DNI) and passports to Argentine citizens and legal residents, and it records vital events such as births, marriages, and deaths. RENAPER operates under the authority of the Ministry of Interior, functioning as the central repository for personal data used in public administration, electoral processes, and social services. Its mandate includes ensuring the accuracy and security of the national identification database, which underpins a wide range of governmental and private sector transactions. As the sole issuer of the DNI, RENAPER holds a unique position in Argentina's identification infrastructure, distinguishing it from other civil registries that may handle only subsets of the population. The agency's work supports both domestic identification needs and international travel documentation, linking citizens to state benefits and legal recognition. RENAPER also collects and stores biometric information, such as fingerprints and facial images, to enhance the security and authenticity of the identity documents it issues. The agency collaborates with other government bodies, including the electoral judiciary and social security institutions, to ensure that identification data is consistent across public services.

In September 2021, RENAPER experienced a significant security breach when an attacker gained unauthorized access through a compromised Ministry of Health VPN account and exfiltrated the national ID card details of the entire Argentine population. The intruder subsequently offered to look up or sell the stolen data, providing evidence that included celebrity records and unique identification numbers. Although officials initially denied any data leakage, the incident was later confirmed as a security event, highlighting vulnerabilities in the agency's remote access controls. This breach followed earlier incidents targeting RENAPER, indicating persistent challenges in safeguarding citizen information. As a public entity, RENAPER is directly accountable to the Argentine national government and does not have a private parent company or subsidiary structure; its operations are funded and overseen by state budgets. Following the breach, RENAPER announced a review of its access control policies and committed to strengthening authentication mechanisms for remote connections. The incident prompted broader discussions in Argentina about the need for improved cybersecurity standards across federal agencies handling sensitive personal data. The agency's role as the custodian of the nation's identification data means that any compromise has broad implications for privacy, security, and trust in public institutions.