Korvea Group

Korvea Group is an emerging Spanish-language cybercrime identity associated with commercialization of identity/data-access products and, under the closely related Korvea Leaks branding, website-defacement activity in Argentina. The principal actor channel is [Telegram identifier redacted].

A prior actor-associated advertisement offered a RENAPER lookup/API product, showed structured samples resembling RENAPER/SID response fields and promoted a broader catalog spanning Argentina, Paraguay, Mexico, Chile, Peru and Ecuador. The evidence supports a data-broker/reseller characterization more strongly than direct compromise of every named upstream institution.

In September 2026, the Municipality of Azul's public website was defaced with the signature -korvea leaks and attacker names Korenvy & stnxz. The page claimed database export; the municipality later confirmed only visual defacement and specifically denied access to sensitive municipal databases.