How an Average of $6 Can Buy Personal Information: Inside Latin America’s “Identity-as-a-Service” Markets

By Assaf Morag, Cybersecurity Researcher

In 2026, a businessman in Lima began receiving photographs of his home, business, and relatives alongside threats against his family. Peruvian police learned that the criminals had obtained the information through a data lookup that turned a telephone number or national identity number into details about the victim and his relatives. The photographs were a direct threat aimed to later extort the businessman. In Peru, this practice is called “doxeo” (doxxing). In Brazil, threat actors call this “puxadas de dadas” (data lookups). Across Latin America, identity-as-a-service has become a popular subscription service that costs on average $6 per month.

Flare collects hundreds of thousands of posts each year dealing with cybercriminals’ interpretation of identity-as-a-service in Latin American underground groups. The examples from Peru and Brazil illustrate the low cost of this operation compared to the high impact. Beyond facilitating cybercrime (online impersonation and various fraud activities), it also enables physical crime such as kidnapping for extortion.

Key Findings About Identity-as-a-Service in Latin America

• Identity lookups have become a commodity service. Telegram and WhatsApp bots across Brazil and Peru sell instant personal data lookups for as little as $3 to $10 per month, with some VIP channels capping membership to keep buyers’ access exclusive.
• The data goes well beyond basic contact details. Packets returned by these bots can include national ID numbers, financial records, employment history, criminal records, vehicle and property ownership, family trees, and in Peru, RENIEC civil registry data that includes fingerprints.
• Demand is driven by real, documented harm. Nearly one in five Brazilians over the age of 16 report being threatened or blackmailed using personal information obtained by criminals, and Peru has seen a sharp rise in extortion cases tied to this kind of data access.
• The problem spans the region. Government agencies in Mexico, Colombia, and Peru have all documented criminal groups using personal data to profile, select, and target victims, including cases where extortionists impersonate relatives living abroad.
• Data quality is inconsistent, but that doesn’t reduce the risk. Records may be outdated or mismatched, but the underlying harm, enabling extortion, impersonation, and physical threats, remains high even when the data itself is imperfect.

The High Demand for PII in Latin America

A survey conducted for the Brazilian Public Security Forum in 2025 found that about 19% of Brazilians aged 16 or older had been threatened or blackmailed by criminals who obtained personal information about them or their relatives. In Peru, the Ministry of Interior documented a sharp increase in extortion between 2019 and 2025, providing another example of a criminal ecosystem in which access to accurate information about potential victims can have significant value.

We observed similar patterns across the region:

• Mexico: The federal government has warned that personal information can end up in criminal hands and be used as a database for extortion and identity theft.
• Colombia: Police have similarly documented criminal groups collecting personal information based on social media sources to select and profile potential victims. In a 2026 investigation, the Colombian National Police reported that an extortion group profiled victims through social media, analyzed their contacts and social environments, identified relatives and friends living abroad, and then impersonated those individuals as part of the extortion scheme.

Interestingly, a recent investigation in Latin America illustrates how illicit access to personal data intersects with physical crime. In Chile, September reporting on the Fodich–Clan Chen investigation described a police employee admitting to 20–30 paid searches of confidential police databases, including searches on individuals who subsequently became victims in the kidnapping and extortion case.

Taken together, examples from Brazil, Peru, Mexico, Colombia, and Chile illustrate the broad criminal demand for PII across Latin America.

The Identity-as-a-Service Digital Ecosystem

Flare’s dataset contains dozens of groups that operate mostly on Telegram and WhatsApp. The attackers largely utilize Telegram bots to manage their operations.

Screenshot taken from a Brazilian underground group

One Peruvian Telegram group offers stolen PII at just $6 per month for unlimited lookups. At that price, a buyer can search for information on as many targets as they want.

Screenshot taken from a Peruvian underground group

The screenshot below illustrates a Brazilian group with over 14,000 members, suggesting these services are quite popular among the Brazilian underground.

Screenshot taken from a Brazilian underground group of the Nexadata bot

Some operators in the Brazilian underground also promote VIP channels with a limited number of members (capped at a few dozen) which may cost between $3 USD and $10 USD per month. This low cost enables threat actors to easily acquire data on their future victims.

The interaction model is simple: a buyer submits one or more pieces of identifying information, such as a name, address, telephone number, or license plate, to an automated bot. In return, the bot returns a compiled profile built from previously stolen data on that person and often their relatives.

The Brazilian evidence shows CPF, name, date of birth, mother’s name, phone lines, income estimates and purchasing power. The Peruvian listing evidence shows property and tax records, debt and credit reports, employment and salary, phone line ownership, criminal, judicial and police records, family trees, civil registry certificates, records from RENIEC, the national civil registry, which contains highly sensitive PII.

Screenshot taken from Flare’s platform of a Peruvian threat actor offering several types of personal and institutional records into one paid lookup (Flare link to post, sign up for the free trial to access if you aren’t already a customer)

The screenshot below shows what an advertisement looks like in a Brazilian underground group’s Telegram channel.

Screenshot taken from a Brazilian underground WhatsApp group

It is important to emphasize that the information sold in these groups is not always reliable, accurate, or updated. Results may combine records collected at different times, producing profiles that contain outdated addresses, disconnected telephone numbers, incorrect financial estimates, or details belonging to completely different persons.

How Threat Actors Abuse this Data

Similarly to all over the world, PII is used for cybercrime, including identity theft, social engineering, scams, fraud, and account takeover. Latin American authorities regularly warn the public about identity related risks, such as through Brazil’s Federal Police and Peru’s Ministry of the Interior.

In addition, authorities run enforcement operations. In July 2026, Peru’s National Registry of Identification and Civil Status (RENIEC), working with the National Police’s Cybercrime Directorate (DIRINCIB), conducted an operation targeting the illegal commercialization of citizens’ personal data in Piura. Authorities arrested a suspect allegedly selling personal information and fraudulent identity-registration certificates, illustrating an active criminal market for PII that can facilitate identity fraud and other downstream crimes.

Lessons for Security Teams

The packets these services sell contain the same facts many organizations still use to confirm who they are talking to: national ID number, date of birth, mother’s name, address and phone lines. For organizations operating in Latin America, the most direct enterprise exposure is identity verification: criminals can use these facts to seek account recovery, SIM replacement, and payment or payroll changes while impersonating legitimate callers.

• Stop treating personal facts as proof of identity. Account recovery, help desk password resets, SIM replacement and phone number changes, payroll and bank detail updates, and supplier payment changes should not be approved on the strength of a CPF, DNI, date of birth or mother’s name. Replace knowledge-based verification with proof the caller cannot look up, such as verification through a previously enrolled authenticator or authenticated approval in an enrolled app. Recovery procedures should not fall back on personal questions when these methods are unavailable.
• Monitor for executives, key staff and their families. Searching lookup channels and bot output for the names, national ID numbers and phone numbers of leadership and their relatives shows whether a profile is already circulating. A match should go to the executive protection or physical security team, because these packets can include home addresses, family trees, vehicle details and photographs. Findings should also inform staff and family briefings. For travel planning, the team should assess whether exposed locations or credible threats affect planned visits, accommodation or transport, and adjust arrangements where warranted.
• Treat ID document images as weak evidence. At least one Peruvian service advertises reproductions of national ID cards and vehicle registration cards alongside its lookups. Onboarding and account recovery processes that accept an uploaded document should add liveness checks and, where the issuing authority offers one, a validation query against the official record.
• Prepare people for the extortion call. The Lima and Colombian cases depend on the shock of a stranger knowing the victim’s home and family. Tell exposed staff and their families that this information is cheap to buy, and agree on a way to confirm a relative is safe before acting on any demand. Threats should go to corporate security and the national police extortion unit.
• Check whether your own systems feed the market. Advertisements for real-time lookups suggest that some services draw on current access to official or commercial databases, through insiders or misused accounts. Organizations that hold customer records, including telecom providers, banks, retailers and registries, should rate-limit and audit record lookups by employee and partner accounts, and alert on query volumes that no business process explains.

On Identity-as-a-Service Markets in Latin America

The accessibility is what makes Latin America’s identity theft markets so dangerous. Only a couple dollars separates someone from accessing a family’s home address, and other PII.

The businessman in Lima mentioned earlier who received photographs of his own home wasn’t a victim of an elaborate hack, and was instead found through a few USD lookup. As these bot-driven markets continue to scale across multiple Latin American countries, the line between data and physical crime keeps getting thinner.