Claro Peru cited in possible data access

An actor identified as z4p3r0c0 claimed to have compromised Claro Peru systems through an exposed API and extracted user data, electronic invoices and credentials. Claro Peru had not officially confirmed the alleged access, the vulnerability, or the information obtained at the time of publication.

What was said about Claro Peru?

According to a post attributed to Alph4 and VECERTRadar, the actor said they gained access to the Peruvian telecom operator's systems through an exposed API. They also claimed to have extracted user data, electronic invoices and credentials. The available material does not include an official response from the company or an independent validation of the technical scope described.

What other references were there in Peru?

The same day, Peru's National Digital Security Center, under the Presidency of the Council of Ministers, published an integrated digital security alert with technical analysis of attacks against public entities and private companies in the Peruvian digital environment. The available excerpt does not identify a specific incident involving energy, telecom, water or transportation.

The Peruvian Navy, meanwhile, said that a cybersecurity conference held in Arequipa addressed the protection of critical infrastructure and critical state assets against digital threats. That communication describes an institutional activity and does not report a specific incident in any critical infrastructure sector.

Based on the material reviewed, the claim involving Claro Peru is the only sector-specific case identified in telecommunications, but it remains unverified by official sources. The provided results do not show a confirmed cybersecurity incident affecting ICS or OT systems tied specifically to energy, water or transportation in Peru.