A RAR archive exceeding 500 MB containing exactly 500 scanned Italian identity documents (identity cards, passports, driving licences) and selfie identification photos was published on a Telegram channel signing as “Anonymous Algeria”, active since November 2025. CERT-AGID notes most files date from 2020–2021, that the dataset may be recycled material consistent with INPS-themed smishing campaigns, and urges reporting, SPID checks, and careful monitoring of bank accounts. #AnonymousAlgeria #CERTAGID
Keypoints
- A Telegram channel calling itself “Anonymous Algeria” published a RAR archive containing 500 scanned Italian identity documents and selfie identification photos; attribution to the known Anonymous collective is uncertain.
- The archive is over 500 MB and contains exactly 500 files including ID cards, passports, driving licences and selfies used for identity verification.
- CERT-AGID reports this is the first known instance of such documents being distributed for free on public channels in Italy; similar material was previously sold on dark web forums.
- Metadata sampling indicates most documents date from 2020–2021 and some are already expired, suggesting the data may be recycled or previously circulated underground.
- The format of the released files matches the type of data collected in INPS-themed smishing and phishing campaigns, though a direct link to a recent breach is not established.
- Exposed documents create concrete risks: unauthorized SPID creation, bank account/credit opening, SIM swapping, and targeted spear-phishing based on document details.
- CERT-AGID recommendations: report to Polizia Postale, verify SPID identities with providers, monitor bank accounts and IBANs, avoid responding to messages referencing specific identity data, and report suspicious SMS/domains to [email protected].
MITRE Techniques
- [None ] No MITRE ATT&CK techniques were explicitly mentioned in the article – ‘No MITRE ATT&CK techniques were specified in the article.’
Indicators of Compromise
- [Telegram channel ] Publication channel used to distribute the archive – “Anonymous Algeria” (channel active since November 2025).
- [Archive / files ] Shared dataset context – RAR archive (>500 MB) containing exactly 500 scanned identity documents and selfie identification images.
- [Domain ] Reporting and law enforcement contact – commissariatodips.it (Polizia Postale reporting portal).
- [Email address ] Reporting endpoint for suspicious material – [email protected].
- [Phishing infrastructure ] Related campaign type but no specific domains provided – “falsi siti INPS” (fake INPS-themed phishing sites) consistent with previously observed smishing campaigns.