PampaLeaks, also called LaPampaLeaks, is a hacker group based in Argentina that claims to sell updated data taken from several governmental and private databases. The group was created by Juan Manuel Lage Machi, known as Uruguayo1337, and is active since at least December 2024. It became notorious for attacking several organs of the Uruguayan government, but all of those attacks were deemed as "superficial" by authorities. Neverthless, Uruguayo1337 was arrested in May 2026 after the group hacked TuID Digital. The group is still active, having broadened the range of their attacks to other Latin American countries, including Peru and Chile.
Description
LaPampaLeaks is a hacker group active in Argentina and Uruguay since December 2024. The group was organized by Juan Manuel Lage Machi (born in 2007), codenamed Uruguayo1337, Agesic and Garro. He is accused of being previously involved with carding. The group's motivation has been described as "anti-progressivism hacktivism combined with monetization through cryptocurrency".
PampaLeaks is specialized in invading governmental organs to scrap personal data and sell it online through their Telegram bot "PampaBot". According to the company Security Advisor, their bot is the first Cybercrime as a Service platform from Uruguay. They are also active in darkweb forums, such as DarkForums and SpearForums. The group received payments through cryptocurrency (Bitcoin, Monero and USDT) and Mercado Pago, if it came from Argentina. The bot was later deactivated, with transactions being made only for "exclusive, trustable people". Amongst the data made available was IDs, means of contact, vehicles, including data about fines and geolocation, education and used devices. Data of famous people, including from the drug dealer Sebastián Marset, was made available to prove the efficiency of the system.
According to the cybersecurity company Brinztech, in September 2026, PampaLeaks used data from governments and telecommunication companies, such as Claro and Movistar, to create a data as a service (DaaS) subscription service called Samaritan API, allegedly providing data of 230 million people from Argentina, Uruguay, Peru, and Chile.
Activities
Dinacia
The group's first notorious attack was on 17 March 2025, when the website of the National Directorate of Civil Aviation and Aeronautical Infrastructure (Dinacia) was defaced. The attack was signed as Uruguayo1337, LaPampaLeaks and BogotaLeaks. The website was defaced with the picture of president Yamandú Orsi as it was on his ID, his cellphone number and the picture of Mauricio Papaleo as it was on his ID, together with a text affirming Uruguay was full of "political corruption, mafias and poverty", and the government only cared about agendas dictated by "2030 Agenda and the World Economic Forum". They've also claimed to be responsible for hacking Obras Sanitarias del Estado (OSE), State Health Services Administration (ASSE), Agency for the Electronic Government and Society of Information and Knowledge (Agesic) and the Ministry of Public Health (MSP). Perpetrators affirmed they've gained access to e-mails, police records and sensible information of politicians and public agents. Most of the e-mails were from Carrasco International Airport and the Ministry of the Interior with information about flights, tickets, data about airplanes and communication with other authorities, including Interpol.
The defacement was first notified by the journalist Eduardo Preve. He identified a post on BreachForums linking the attack to PampaLeaks from Argentina, with the aid of BogotaLeaks. The group supposedly got the VPN access of the Ministry of Interior and SGSP credentials from Uruguayo1337. Initially, Leonardo Blengini declared to Telemundo that the hackers didn't get the alleged information, and the hacking happened on the surface of Dinacia's portal. Uruguayan Air Force commander Fernando Colina declared that the technicians were analyzing the damage to determine what actions have to be taken. The Uruguayan government described the attack as "superficial" and affirmed the information gathered was originated in older public sources.
Ministry of the Interior
On 29 March 2025, the Ministry of the Interior announced they suffered a cyberattack from PampaLeaks that resulted on the leakage of some internal documents and the fall of the .gub.uy domains at 14:30 for some minutes. According to the Ministry, the group used previously leaked keys to enter the system.
Freemasonry
Hours after the attack on the Ministry of the Interior, PampaLeaks hacked the Uruguayan Freemasonry. They've allegedly scrapped more than 13 GB of data, including members lists, internal documents, personal data and Zoom recordings. Among the documents were people being scouted to join the Freemasonry, reintegrated members, internal regulations, minutes and correspondence and recordings of rituals. Their website was also defaced. The files were posted on the Ministry of Industry, Energy and Mining's defaced website under the name "Masoneríafiles". The leak was first reported by the Twitter account Criminal Mambo. Freemasons have told Telenoche that the information leaked was all superficial. PampaLeaks tried to sell the remaining data affirming it contained documents that linked the Freemasons with "crimes and conspiracies against the public order", but the information was deemed as false by the security company Birmingham Cyber Arms.
CREA
On 30 September 2025, PampaLeaks affirmed to have gathered information of more than one million Uruguayans who used educational devices, such as laptops and tablets, and published the data of 33 thousand people as a sample. The hack allegedly happened in July 2025. The number of people allegedly hacked was close to the number of profiles from Contenidos y Recursos para la Educación y el Aprendizaje (CREA), an educational platform of the Ceibal project. The Government affirmed they explored a vulnerability of one profile inside the platform, and from it, basic data from other users was gathered, but their database was not breached. A few days later, the educational platform GURI was also hacked.
Uruguayan news media, such as Teledoce, affirmed data also came from attacks against National Administration of Public Education (ANEP) and Universidad ORT Uruguay, besides scrapping from Sistema Único de Cobro de Ingresos Vehiculares (Sucive), Intendancy of Montevideo and the National Direction of Civil Identification. When questioned, the Agency of Electronic Government and Society of Information and Knowledge (Agesic) affirmed it couldn't confirm the outlets' claims. Later, the attacks against Sucive, ANEP, Universidad de la República and National Party were linked to another hacker group called ExPresidents.
TuID Digital
On 7 May 2026, PampaLeaks affirmed in darkweb forums they have explored a breach on TuID Digital, National Telecommunication Agency's electronic identification platform, to gain access over personal data linked to identity, facial biometry and fingerprints. The attack came to light through a Twitter account named IBreaches. They've also sent a message to the chief of Cybersecurity of the Ministry of the Interior asking to be contacted in 24 hours, otherwise other attacks would follow. The hack has supposedly been achieved through exposed API credentials and backend archives. PampaLeaks posted the supposed feat on the darkweb, but it came to light through posts made by the Twitter account Indian Breaches. The group affirmed they stole 8 GB of data, including business proposals, legal documents, information about infrastructure and technology, backend and frontend documentation and numeric portability data. To prove their feat, they exposed data of famous personalities, including senator Graciela Bianchi, AGESIC's ex-director Daniel Mordecki and the journalist Eduardo Preve. Montevideo government acknowledged there was an attack on their identification system, but that their authentication keys were intact and no sensible data was leaked. They activated their safety protocols and made a formal complaint to the Attorney General's Office of Uruguay and the Ministry of the Interior.
On 18 May 2026, LaPampaLeaks affirmed they've used TuID's and other government databases to develop a tracking tool better than PampaBot. According to them, data was updated due to their access to "most databases of Uruguayan Governmental organs" and "direct access to Governmental systems". They offered their services by payments done with bitcoin, and to prove their claims they've leaked data from important politicians, including ex-president Luis Lacalle Pou, Ministry of Interior Carlos Negro and Secretary of the Presidency Alejandro Sánchez Pereira. Antel said no major leakages happened, and a maximum of 163 people had their biometric data compromised.
National Register of People
On 3 June 2026, PampaLeaks affirmed they hacked Argentina's National Register of People (RENAPER). According to the cybersecurity company Vecert Analyzer, the group published the API endpoints and data from several public figures of Argentina, including Preseident Javier Milei, ex-president Cristina Kirchner, Lilia Lemoine and employees of the Secretary of IntelLigence of the State.
Other attacks
PampaLeaks is accused of hacking La Diaria's database, the Administration of Health Services of Montevideo, the shopping mall Las Piedras on 17 March 2024, the company Buquebus on 25 March 2025, and the Ministry of Social Development.
Arrest
Juan Manuel, also known as Uruguayo1337, was already known to the police. He was investigated for the attacks against Dinacia and Buquebus by the Unit of Cybercrime of the Department of Crimes Against Systems of the National Police of Uruguay. He was prosecuted by the 42° Penal Court, where his other alleged hacking activities were added to the case, and in March 2025 he was on 180 days of preventive detention. In November, another hacker related to the case was found guilty of data theft, "computing damage", storage of child pornography and falsification of public documents. He was condemned to ten months of jail, followed by two months of house arrest and ten months in probation, a fine of US$9.500 and his name was registered on the National Register of Rapists and Sexual Abusers.
Shortly after the TuID hack, Uruguayo1337 was arrested by the National Police. The police have declared he was arrested somewhere in May 2026, and his peers have declared he was arrested on 26 May. Despite being arrested, his Telegram channels kept operating. He was identified by an investigation done by the British company BCA LTD and a legal complaint made by one of the victims. The company discovered his identity due to a fight amongst PampaLeaks and ExPresidents. Since 2024, Uruguayo1337 accused ExPresidents of being politically motivated, and somewhere in 2025 ExPresidents doxxed data from three hackers, including Uruguayo1337. BCA then found his cellphone number and linked his Telegram ID to PampaLeaks groups, which led to his arrest.
References