Paraguay Sees More Phishing Complaints

Complaints in Paraguay are rising over identity theft, phishing, bank account draining and the theft of messaging and social media accounts, according to specialist Miguel Ángel Gaspar in an interview published by a Paraguayan outlet. In the same coverage, he said more than 9 million data records were exposed on the web, calling that volume the biggest attack vector in a long time, and possibly the largest in the country’s history.

What did Gaspar say about the growth in attacks?

Gaspar said complaints in Paraguay are increasing for identity theft, phishing, draining of bank accounts, and theft of messaging and social media accounts. He said cybercriminals are using AI to improve their attack vector, according to the interview published by Caaguazú Noticias Digital.

What weight did he give to data exposure?

The specialist said more than 9 million data records were exposed on the web in Paraguay. In the same coverage, he said that volume represented the biggest attack vector in a long time, or even the biggest in the country’s history. The warning points to the availability of personal information as fuel for identity fraud.

The reference lines up with material from Kaspersky Latam, which explains that overexposure of personal data, such as identity documents, addresses, phone numbers and financial information, raises the risk of identity fraud and impersonation by helping attackers bypass security checks. It also matches technical analysis of phishing and account theft campaigns that capture credentials, phone numbers and one-time authentication codes to hijack access and reuse passwords on other services.

What other events provide context for that risk in Paraguay?

Paraguayan prosecutors carried out an IT forensic review of Copaco’s Administrative Financial System in a case involving the alleged diversion of about G. 1.1 billion into personal accounts. The case raises the possibility of internal abuse of systems and credentials at a telecommunications company that is central to the country’s digital and financial ecosystem.

At the same time, La Nación Paraguay’s coverage of alleged scams involving a supposed AI model clarified that, at that point, there was no confirmation that the profile was AI, and no formal complaints about the supposed money scams. That nuance leaves the technical attribution open and requires separating a suspected fraud from a forensic confirmation.

Internationally, the ClarityCheck global leak exposed 9,042,977 face image and profile files, with an estimated size of 450 GB. Later analysis indicated that the database was hosted in a public cloud without a password or encryption, with folders labeled "faces" and "profiles," which heightens the risk of biometric reuse and the creation of fake identities.

That context adds to reports on the 2024 Snowflake breach, where data from more than 160 organizations was said to have been stolen through reused credentials. It also adds another layer to a phishing campaign blocked by Check Point, based on debt forgiveness and financial aid, and Malwarebytes’ analysis of TikTok scams, where attackers capture credentials and authentication codes to take over accounts and move the attack to other services.