Summary

  • LACNIC says some people registered for LACNIC 46–LACNOG 2026 may have received emails offering databases with attendee information. It says the messages were neither sent nor authorized by LACNIC.
  • LACNIC also says it does not sell or trade databases containing event registrants' contact information and advises recipients not to reply, pay or share personal information.
  • The official attendee page exposes names, organizations, participation modes and countries, but no email column. That makes public compilation conceivable while leaving the source of the solicitation addresses unresolved.
  • The appropriate public control is a versioned origin-and-classification record that can distinguish a reported offer, an observed schema, public compilation, external enrichment, suspected internal exposure and confirmed compromise without exposing personal data.

A database offer contains at least three claims, even before anyone opens an attachment. It claims that a dataset exists. It claims that the seller can deliver it. It implies that the records came from somewhere worth paying for. None of those claims authenticates the next one.

That distinction is the centre of LACNIC's 23 September notice about LACNIC 46–LACNOG 2026. The organization says it became aware that some registered individuals may have received emails offering databases containing information about event attendees. It says the messages were neither sent nor authorized by LACNIC. It also says LACNIC does not sell or trade databases containing contact information for people who register for its events. Recipients are told not to reply, make a payment or share personal information.

The warning does two things well. It establishes the authorization boundary, and it gives a reader a safe immediate action. It does not turn a report into an accusation about LACNIC's systems. The word “may” also matters. The notice does not publish a verified recipient count, identify a sender, describe an offered file or say that anyone bought one.

That restraint should be preserved. “Unauthorized solicitation” and “confirmed data breach” are not two phrasings for the same state.

Four public fields do not reveal the fifth field's source

The official LACNIC event system provides a public attendee surface for the October meeting in Mendoza. At the 27 September evidence cutoff, it reported a changing total of 572 registrations. The number will move as registration moves, so it is not a final attendance figure. The stable observation is the table structure: name, organization, participation mode and country.

No attendee row was needed for this analysis, and none has been retained here. The schema is enough.

Those four fields make one source class plausible. A third party can collect publicly displayed names and organizations, package them as an “attendee database,” and add marketing language. It can then try to find work addresses elsewhere. That would still be unauthorized solicitation, even if the public columns were gathered from a page anyone could view.

But plausibility is not proof. The fact that an email reached a registered person does not show whether the address came from the registration platform, a company's website, an older conference list, a commercial contact broker, a guessed address pattern, a compromised third party or a different source altogether. The warning does not say which fields were offered. It does not say whether the seller possessed email addresses inside the advertised dataset or merely used email to advertise four public columns.

The opposite shortcut is equally unsafe. The existence of a public list does not prove that the offer was assembled only from public data. A seller could mix public identifiers with private contact details. An unrelated list could be marketed under the LACNIC 46 name. An internal exposure remains a possible investigation state in the abstract. The reviewed public record confirms none of these routes.

The responsible sentence is therefore narrow: no breach is confirmed in the reviewed public evidence. That is not the same sentence as “no breach occurred.”

The offer, the message and the source need separate identities

An incident record should not begin with a binary label. It should begin with evidence objects.

First is the recipient report: who reported a message, when it arrived and whether the recipient was in fact registered. That material is private. Second is the message sample: sender path, headers, destination, payment request, links, attachments and the seller's exact wording. That material may be sensitive and operationally useful; it does not belong on a public article page.

Third is the advertised schema. Did the seller name only people and organizations already visible on the public attendee page? Did the pitch claim to include email, telephone, job title, payment state or another non-public field? A safe public update can describe field classes without reproducing a record.

Fourth is source comparison. Investigators can compare a protected sample with the event system, the public page, authorized service-provider access and other known lists. A match does not automatically prove extraction: common names and business addresses travel across datasets. A distinctive non-public field, an internal identifier or a pattern of records created after a known cutoff would carry a different evidentiary weight.

Finally comes classification. “Reported,” “sample preserved,” “public compilation consistent,” “external enrichment consistent,” “internal exposure suspected,” “compromise confirmed” and “closed without confirmation” are different states. Each should have a timestamp, an owner and a reason. A later correction should not erase the earlier classification; it should supersede it.

LACNIC's privacy promise and its public warning play different roles

LACNIC's privacy policy applies to event and course registration. It says personal data is handled with confidentiality and security, kept for the purpose for which it was collected, and shared with third parties only in listed circumstances such as inherent public or community publication, explicit consent, necessary service providers or lawful requests.

That policy defines an obligation. It does not establish what happened in this episode. Quoting a security promise cannot prove that a control succeeded; nor does an unsolicited email prove that it failed. The missing join is between the report and the source assessment.

LACNIC also operates a CSIRT with incident-reporting, advice-brokering and security-warning services. Those pages show that a confidential response channel exists. They do not say that this particular event has been classified by the CSIRT. Assigning a process that the public record does not assign would be another form of overclaiming.

The public need is smaller. Registrants do not require access to forensic samples. They need to know the current evidence state, the safe action, the field classes under review, the time of the last update and where to send a message they received. If the assessment changes, they need a correction that says what changed.

A compact origin-and-classification record

The useful public record could fit beside the warning. It would identify the event and notice version; state how many reports have been authenticated in a thresholded, privacy-safe aggregate; describe the observed offer by field class; distinguish public attendee fields from non-public contact fields; publish the current source classification; name the responsible channel; and show the last update and correction history.

The protected record would carry the rest: recipient identity, message headers, hashes of preserved samples, sender infrastructure, payment instructions, offered files, comparison method, authorized-access review and investigative notes. Publishing those materials could help the sender, expose victims or create a new copy of the very data under review.

This is not a demand that LACNIC declare a breach without evidence. It is the opposite. A status record protects the institution from unsupported escalation while preventing an early signal from disappearing into the generic category of spam. It permits the conclusion to remain “unresolved” until the evidence supports something narrower.

The earlier governance question around the LACNIC 46 attendee page was how consent, field scope, visibility duration and removal should be recorded. The new warning creates a different object. It is no longer only about the life of an authorized public list. It is about the provenance of an unauthorized commercial claim made to people connected with that list.

The most credible response is neither silence nor certainty. It is a visible state that can change.

Sources

  1. LACNIC — Information about LACNIC 46 – LACNOG 2026
  2. LACNIC Events — LACNIC 46 public attendee surface
  3. LACNIC — Privacy Policy
  4. LACNIC CSIRT — Services
  5. LACNIC CSIRT — FAQ