This is not scaremongering. They are documented facts, verified by threat intelligence (VECERT Analyzer), and affect companies, citizens and brands in Ecuador right now.
⚠️ Risk level: CRITICAL
The Ecuadorian digital ecosystem — identity, access and data — is compromised in multiple layers simultaneously.
The facts: who was affected?
🏛️ Government and public sector
- DIGERCIC (Civil Registry) → massive leak of national identity. The most critical level possible: names, IDs, dates of birth of millions of Ecuadorians.
- Ministry of Public Health → Zimbra accounts compromised and actively for sale in underground forums.
- National Arms Control System → unauthorized administrative access detected on February 1, 2026. Risk level: critical.
🏦 Financial sector
- Banco de Machala → exposure of client financial data.
- BancoCapital Ecuador → leak of credentials, emails and complete database via compromised WordPress.
🏥 Private health
- RELIV → more than 100GB of exposed private medical documents. Posted by actor “juliusdeane” on November 5, 2025.
🏨 Tourism and hospitality
- HotelesEcuador.ec → customer database leaked through BreachForums. Detected on December 12, 2025.
🎓 Academia + Government
- 20 entities (universities + public institutions) → Zimbra accounts committed in block. Actor: “freshtools”. Date: November 10, 2025.
📱 Data infrastructure / Telecom
- Massive database of Ecuadorian telephone numbers circulating in underground forums. Actor: “saxawe1742”. Date: November 3, 2025.
🪪 Citizen data
- 9,000 Ecuadorian ID cards with full names and dates of birth, published as a sample. Actor: “HvcKMvsoneria33”. Date: October 7, 2025.
Strategic reading: they are not separate incidents
The most common mistake is to analyze each case in isolation. When you see them together, the pattern appears:
🪪
Layer 1: Identity** DIGERCIC, massive ID cards
The most critical
🔑
Layer 2: Access** Emails, credentials, banks
entrance door
💰
Layer 3: Exploitation** Medical information, tourism, telephone numbers
Monetization
When an attacker has identity (who you are), access (your passwords and emails), and exploitation data (your medical history, your bank, your phone), they can construct hyper-segmented phishing attacks, targeted financial fraud, and targeted extortion.
What does this mean for your business?
If you have a company in Ecuador, the question is not “will it affect me?” but “has it already affected me and I don’t know?”. The data of your customers, your employees and your infrastructure are part of the same committed ecosystem.
The most specific risk vectors for businesses:
- Targeted phishing using real data from your clients (they already have their IDs and telephone numbers).
- Theft of corporate credentials via compromised email accounts.
- Identity fraud against employees or executives.
- Reputation: if your customer data circulates in forums, the damage is yours.
Real cases: how these attacks materialize
To make the risk more tangible, let’s see how this compromised data turns into concrete attacks:
Scenario 1 — Phishing with real data. An attacker obtains IDs and names from DIGERCIC filtering. It sends an email that appears to come from the SRI, with your full name and ID number, informing you about a “pending tax refund.” The link takes you to a fake page that captures your banking credentials. would you fall? If the email has your real name and your correct ID, the probability of you falling increases dramatically.
Scenario 2 — Corporate identity theft. With leaked credentials from BankCapital or Banco de Machala, an attacker accesses your corporate email. From there send transfers with false instructions to your clients or suppliers. The email comes from your real address, with your usual tone. Are your suppliers going to hesitate?
Scenario 3 — Extortion with medical data. RELIV’s 100GB of medical data contains sensitive diagnoses, treatments and histories. An attacker can contact patients directly and threaten to publish their medical records unless they pay. This has already happened in other countries in the region.
What does this mean for your business? (continuation)
Beyond the above scenarios, there is a reputational risk that many businesses underestimate: if your customers discover that their data is on the dark web and you did nothing to protect it, the damage to your brand may be irreversible. In a market like Ecuador, where trust is built slowly and lost suddenly, cybersecurity is not a technical issue — it is an issue of business survival.
Cybersecurity also depends on identifying exposed services and applying updates on time.
What you can do now
- ✅ Audit your team’s access credentials (unique passwords + 2FA).
- ✅ Check if your domain or emails appear in compromised databases.
- ✅ Implement security headers on your website.
- ✅ Have a response protocol if you detect a breach.
- ✅ Monitor mentions of your brand on the dark web.
Practical guide: step by step to protect your business
Step 1 — Change all reused passwords. If you use the same password on more than one service, start there. Use a password manager (Bitwarden, 1Password) to generate unique passwords of at least 16 characters. This alone reduces your exposure by 80%.
Step 2 — Activate two-factor authentication (2FA) on everything. Corporate email, social networks, bank accounts, management platforms. If a service offers 2FA, activate it. Prioritize app authenticators (Google Authenticator, Authy) over SMS.
Step 3 — Check your exposure. Tools like Have I Been Pwned (haveibeenpwned.com) allow you to check if your email or domain appears in known leaks. Do it today — it’s free and takes 30 seconds.
Step 4 — Train your team. 95% of successful cyberattacks exploit human error, not technical vulnerabilities. An hour of training on phishing, strong passwords, and being suspicious of unexpected emails can save you thousands of dollars.
Step 5 — Update your software. Operating systems, browsers, WordPress plugins, CMS. Known vulnerabilities are the easiest entry point for attackers. If an update is available, install it.
Step 6 — Hire a security audit. If your business handles sensitive customer data (financial, medical, personal), a professional audit is not a luxury — it’s a necessity. A basic pentest can reveal vulnerabilities you didn’t know existed.
Why is Ecuador such an attractive target?
Several factors make the Ecuadorian digital ecosystem particularly vulnerable:
Concentration of data in a few providers: When a single provider (such as CNT or DIGERCIC) stores data from millions of citizens, a single breach affects a huge proportion of the population.
Accelerated digital adoption without equivalent security: the digitalization of public and private services in recent years was not accompanied by a proportional investment in cybersecurity.
Specialized talent shortage: Ecuador has a significant gap in certified cybersecurity professionals, making it difficult for organizations to implement adequate defenses.
Regulatory frameworks still developing: Personal data protection legislation in Ecuador is evolving but does not yet have the punitive force of frameworks like GDPR in Europe.
Weak security culture: Many organizations still view cybersecurity as an unnecessary cost rather than an investment in business continuity.
The impact on digital trust
Beyond the specific attacks, there is a collateral effect that affects everyone: the erosion of digital trust. When citizens see that their most sensitive data (identity cards, medical records, financial information) circulates freely on the dark web, the natural response is to distrust any digital platform. This slows the adoption of technology, affects legitimate businesses that depend on digital channels, and feeds back into a cycle of distrust that harms the entire economy.
Companies that want to break this cycle must actively demonstrate that they protect their customers’ data. It’s not enough to have a privacy policy on the website — you have to communicate the security measures you implement, respond transparently if something goes wrong, and make cybersecurity part of your value proposition.
Do you want a free security diagnosis for your company?
At EMA we review your digital exposure and give you a specific protection plan.