Executive Summary

Eternal Leaks announced the sale of a dataset it describes as containing 305,852 tuberculosis-related records from Mexico, with claimed coverage across all 32 federal entities and a stated time range from March 2022 through September 2025.

The material was offered for 12,500 Mexican pesos and presented as an approximately 1.31 GB file. What distinguishes this publication from a simple criminal sales advertisement, however, is the existence of a substantive sample that allows part of the offer to be independently assessed.

iQBlack examined 4,000 valid and structured JSONL records, each containing 193 fields. The information observed includes direct identity attributes, Mexican government identifiers, demographic and contact data, healthcare institutions, diagnosis, treatment, tuberculosis localization, comorbidities, and other clinical and administrative variables.

The available evidence does not yet confirm the advertised total of 305,852 records or establish how the data was originally obtained. It does support a more significant conclusion: Eternal Leaks is commercializing access to identifiable healthcare information concerning people affected by a sensitive medical condition, and the material examined goes well beyond a mere advertising claim.

When Clinical Data Becomes a Commodity

A corporate database may contain email addresses, phone numbers, or administrative information. In this case, those attributes appear alongside health information, treatment data, medical institutions, and tuberculosis case-management details.

That distinction is significant. If the complete dataset retains the characteristics observed in the sample, anyone obtaining access to it could potentially associate a specific individual with a medical condition, their relationship with the healthcare system, and other personal attributes that would ordinarily remain confined to medical or epidemiological environments.

The exposure therefore extends beyond a conventional confidentiality issue. Information of this nature could acquire downstream value for highly tailored social engineering, identity fraud, coercion, discrimination, individual targeting, or further criminal resale. The current evidence does not show that Eternal Leaks is carrying out those follow-on activities, but commercialization removes any meaningful control over who may acquire the material or how it may subsequently be used.

In that sense, one point becomes difficult to ignore: clinical information belonging to potentially vulnerable individuals does not appear to fall outside the category of assets Eternal Leaks is willing to turn into a commercial product.

The Sample Changes the Level of Evidence

The existence of the sample makes it possible to move beyond the actor’s own description. The 4,000 records examined present a uniform and technically consistent structure. The file is approximately 17.96 MB, and extrapolating its average record size across the advertised 305,852 records produces a result close to the approximately 1.31 GB volume promoted by Eternal Leaks. This does not validate the complete file, but it makes that element of the offer technically plausible.

All 32 Mexican federal entities are also represented within the sample. Several geographic, institutional, and clinical distributions show meaningful proximity to the statistics advertised by the actor, although other differences prevent the 4,000 records from being treated as a statistical replica of the full dataset.

Observed dates extend into September 2025, supporting the upper end of the advertised time range. The claimed March 2022 starting point, however, cannot be independently validated from the subset available.

The conclusion must therefore remain limited: the sample supports the existence of a substantive and structured healthcare dataset, but it does not establish the full scale of the material being marketed.

What the Case Reveals About Eternal Leaks

There is also a fundamental distinction between possessing the data and having compromised the system that originally stored it.

The observed structure is consistent with information used for tuberculosis case management or epidemiological surveillance. The sample, however, does not provide sufficient evidence to identify the original technical source or reconstruct how the material came into Eternal Leaks’ possession.

It is not currently possible to determine whether the data resulted from direct exploitation, compromised credentials, insider access, an exposed database, third-party acquisition, or resale.

That uncertainty does not diminish the commercial significance of the case. The actor established a specific price and provided a contact through which the transaction could be arranged. The publication therefore illustrates a model in which healthcare information functions directly as a commodity, rather than being used solely for reputational exposure or free distribution.

For the actor’s characterization within 3C-INT, that matters as much as the alleged original compromise.

When Monitoring Changes What We Know About an Actor

The case also produced a material change in iQBlack’s ongoing assessment of Eternal Leaks. The emergence of a new geography, a highly sensitive healthcare domain, recoverable technical evidence, and an explicit commercialization model altered important elements of the actor’s existing characterization.

As a result, 3C-INT generated a Strategic Intelligence Update, part of the service workflow through which authorized clients receive daily strategic PDF updates when monitoring identifies relevant changes in actors, victimology, capabilities, relationships, or operational patterns.

In this case, the update incorporates the Mexico and public-health exposure, technically evaluates the available sample, records the observed monetization model, and revises the confidence levels associated with Eternal Leaks’ different assertions.

The resulting assessment preserves a critical distinction: there is high confidence that the sample contains 4,000 structured healthcare records with direct identifiers and clinical information, while confidence in the advertised full volume and the original technical provenance of the data remains substantially lower.

The purpose is not to convert every actor publication into an isolated alert, but to identify when new evidence changes what is known about the actor.

Analytical Closing

Eternal Leaks is not merely offering hundreds of thousands of database rows. If the description of the complete dataset proves substantially accurate, what is being commercialized is the ability to associate specific individuals with tuberculosis information, treatment data, healthcare institutions, and other highly sensitive clinical and administrative attributes.

The available sample provides sufficient evidence to assess that real and structured healthcare information sits behind the advertisement. It is not sufficient, however, to validate the complete record count or attribute the original compromise of the environment in which those records were generated to Eternal Leaks.

That limitation leads to a clear observation: within Eternal Leaks’ commercial model, even highly sensitive clinical information can become an asset assigned a price and offered to third parties.

And that behavior, regardless of who originally obtained the data, materially changes the characterization of the actor.