Claims circulating on hacking forums allege that two databases containing sensitive information related to individuals and organizations in Iraq have been exposed.
The first claim concerns a database reportedly linked to government job applications in Kirkuk. According to the claim, the information may include names, dates and places of birth, phone numbers, identification details, addresses, marital status, spouse and children information, qualifications, and job application records.
The database is reportedly around 178GB in size. While this is unusually large for job application data and may indicate the presence of attachments, the size of a database alone does not confirm the number of records or prove that a breach occurred.
A second claim refers to approximately 1.5GB of data allegedly related to Iraqi military and security personnel, including personal information and details about units.
At present, there is no independent confirmation that Kirkuk government systems or Iraqi military and security organizations were breached.
However, if the data is genuine, it could create significant social engineering risks. Threat actors could use personal, employment, or family information to make fraudulent calls, messages, or impersonation attempts appear legitimate. Family members could also be targeted.
Individuals should avoid sharing OTPs, passwords, or identity documents, verify unexpected requests through official channels, and avoid reusing passwords across accounts.
Organizations should also alert employees, monitor for impersonation and phishing attempts, and watch for unusual activity involving affected accounts or identities.
Data appearing on a hacking forum should not be treated as proof of a confirmed breach. Further independent verification is required.