Defensoría del Pueblo de Colombia – Protection and Promotion of Human Rights Listed by kazu Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target public institutions that hold sensitive citizen records, using leak-site listings to pressure organisations into paying. Against that backdrop, the Defensoría del Pueblo de Colombia was named on 8 November 2025 by the group known as kazu, which claimed to have carried out a ransomware attack involving the exfiltration of internal files. The number of people affected remains unknown, and public detail on the precise scope is limited.

The listing matters because the Defensoría is a constitutional body charged with protecting human rights across Colombia. Any compromise of its systems can expose both operational material and information linked to vulnerable populations who rely on the institution for complaints, guidance and oversight.

Inside the incident

According to the available record, the Defensoría del Pueblo de Colombia was listed by the kazu ransomware group on 8 November 2025. The group claims that internal files were exfiltrated during a ransomware attack. No further technical details—such as the initial access vector, the duration of unauthorised access, the volume of data taken, or any ransom demand—have been publicly confirmed. The number of individuals potentially affected is listed as unknown. The incident is therefore known primarily through the group’s leak-site claim rather than through independent verification or an official detailed disclosure.

Inside kazu

Kazu is a ransomware operation that, like many contemporary groups, follows a double-extortion model: encrypting systems while also claiming to steal data and threatening to publish it if payment is not made. Such groups typically advertise victims on dedicated leak sites to increase pressure. Public reporting on kazu has described it as one of several actors that list public-sector and private organisations, often providing limited samples or descriptions of stolen material. In this case the group claims the Defensoría was a victim and that internal files were taken; those assertions have not been independently corroborated in the material available for this account. No specific statements by kazu beyond the listing itself are recorded here.

Who is Defensoría del Pueblo de Colombia?

The Defensoría del Pueblo de Colombia is a constitutional and autonomous institution responsible for promoting, protecting and defending human rights throughout the country. It operates independently of the executive, legislative and judicial branches. Its official portal serves as a public platform where citizens can obtain information about their rights, file complaints, seek legal guidance and follow the institution’s oversight and advocacy work. The Defensoría pays particular attention to vulnerable populations and monitors whether state entities respect fundamental rights. Organisations of this type routinely handle case files, correspondence, personal identifiers of complainants, and internal working documents related to investigations and recommendations. A breach affecting such a body therefore carries consequences that extend beyond ordinary administrative disruption.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory—such as specific categories of personal data, case records, employee information or technical documents—has been disclosed. Public institutions that defend human rights typically hold complaint dossiers, contact details of individuals seeking assistance, internal reports, and correspondence with other state bodies. Because the exact contents remain unconfirmed, it is not possible to state with certainty which of those categories, if any, were among the files claimed to have been taken. The absence of a detailed inventory leaves affected parties without clear confirmation of what personal information may have been exposed.

Why it matters

For individuals who have interacted with the Defensoría, the principal risk is that personal or case-related information could be misused for identity fraud, targeted harassment or further social-engineering attempts. People who have filed complaints about rights violations may be especially sensitive to any leakage of their details. For the institution itself, the incident can undermine public trust, disrupt services that citizens rely on, and create ongoing operational costs related to investigation, system recovery and notification. Because the Defensoría’s mandate centres on protecting vulnerable groups, any erosion of confidence in its ability to safeguard information can have wider civic effects. The unknown scale of the exposure adds uncertainty for both the organisation and those who may have been affected.

What to do if you're exposed

If you have had dealings with the Defensoría del Pueblo de Colombia and are concerned that your information may have been involved, practical first steps include the following:

• Monitor financial and government accounts for unexpected activity and enable multi-factor authentication wherever available.
• Treat unsolicited messages that reference rights complaints or official processes with caution; verify any request through official channels rather than links or attachments in the message.
• Consider placing fraud alerts with credit-reporting services if you believe personal identifiers were held by the institution.
• Keep records of any correspondence you have had with the Defensoría so you can more easily identify unusual follow-up contacts.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; this can provide an early indication that further monitoring is warranted.

Official updates from the Defensoría or Colombian authorities, if issued, should be treated as the primary source of confirmed information. Until more detail is released, the prudent course is measured vigilance rather than assumption of the worst-case scenario.

AICompiled with AI assistance from public sources and published under our editorial standards.