{ "id": "57bd1f70-f8cc-43e6-806a-60ff713593f9", "created_at": "2026-04-06T00:15:16.770736Z", "updated_at": "2026-04-10T13:11:56.827011Z", "deleted_at": null, "sha1_hash": "50b9b57f069ba7a76d3a933fce7ea3f8e5b660eb", "title": "USDoD Hacker Behind $3 Billion SSN Leak Reveals Himself as Brazilian Citizen", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 86205, "plain_text": "USDoD Hacker Behind $3 Billion SSN Leak Reveals Himself as\r\nBrazilian Citizen\r\nPublished: 2024-08-23 · Archived: 2026-04-05 19:46:45 UTC\r\nInfamous hacker USDoD, linked to major data breaches, reveals his identity as a Brazilian citizen. Discover the\r\nimplications and how Brazil’s extradition treaty with the US may affect his future.\r\nUSDoD, also known as EquationCorp, an infamous hacker responsible for some of the most high-profile data\r\nbreaches, has come forward and revealed his identity as Luan G, a 33-year-old man from the state of Minas Gerais\r\nin Brazil.\r\nThe personal Instagram the hacker shared with Hackread.com\r\nThe infamous hacker recently made headlines for breaching the US-based API firm National Public Data and\r\nleaking more than 3.2 billion Social Security Numbers (SSNs) online. Prior to that, USDoD breached the FBI’s\r\nsecurity platform, InfraGard, and exposed the personal details of 87,000 members. The hacker has also been\r\ninvolved in several other significant data breaches and web scraping incidents.\r\nIn an exclusive conversation with Hackread.com, which included a short video message from the hacker, USDoD\r\nacknowledged that he was “doxed by CrowdStrike,” a cybersecurity firm recently in the news for a bad update\r\nthat caused global disruption of Windows devices.\r\nDiscover more\r\nNetwork Security\r\nComputer Security\r\nCybersecurity training courses\r\nSo, what does CrowdStrike have to do with the USDoD hacker? The conflict between USDoD and CrowdStrike\r\nbegan in July 2024, when the hacker announced that he had scraped and leaked a 100,000-line Indicator of\r\nCompromise (IoC) list from the company. Apparently, it took CrowdStrike less than a month to “dox” the hacker\r\nin response.\r\nhttps://hackread.com/usdod-hacker-ssn-leak-reveals-brazilian-citizen/\r\nPage 1 of 3\n\nOn the other hand, the USDoD hacker provided a statement to Hackread.com, revealing his ambition to turn his\r\nlife around, leave the cybercrime world behind, and do something positive for Brazil.\r\n“So congrats to Crowdstrike for doxing me, they are late for the party, intel421 Plus and a few other\r\ncompanies already doxed me even before the Infragard hack. I want to say thank you, it is time to admit\r\nI got defeated and I will retire my Jersey. Yes, this is Luan speaking. I won’t run, I’m in Brazil, the same\r\ncity where I was born. I am a huge valuable target and maybe I will talk soon to whoever is in charge\r\nbut everyone will know that behind USDoD I’m a human like everyone else, to be honest, I wanted this\r\nto happen, I can’t live with multiple lives and it is time to take responsibility for every action of mine\r\nand pay the price doesn’t matter how much it may cost me. This is not my end. Thank you, see you\r\naround. Don’t worry Brazilian authorities, I’m coming to meet you, I’m not a threat, in fact, I can do\r\nmuch for my country.”\r\nHackread.com has reached out to CrowdStrike for comment. Meanwhile, according to the Brazilian news site\r\nTecMundo, CrowdStrike has already shared its findings with the relevant authorities in Brazil.\r\nCommenting on this, John Bambenek, President at Bambenek Consulting, argued whether the hacker is serious\r\nabout leaving cybercrime: “If he was serious about turning his life around, he could turn himself in at the nearest\r\nembassy, get a sweetheart plea deal, and in 3-5 years, he’ll be the figurehead of some new cybersecurity company\r\nmaking mid-six figures. It’s a well-worn path that many former computer crime convicts have travelled.“\r\nDiscover more\r\nAntivirus \u0026 Malware\r\nTechnology News\r\nHacking \u0026 Cracking\r\n“That said, considering this interview has taken place mere moments after the NPD breach, I suspect it’s a novel\r\ntechnique by a threat actor throwing mud in the water and creating a PR smoke screen for continued\r\nmisbehaviour,“ John added.\r\nThe United States and Brazil extradition treaty\r\nThe revelation of the USDoD hacker’s alleged identity as a Brazilian citizen has significant implications,\r\nparticularly given his involvement in high-profile data breaches. Under the Brazil and US Extradition Treaty, the\r\nU.S. could request his extradition to face charges for his cybercrime.\r\nHowever, Brazil has a history of not extraditing its own citizens, which could complicate efforts to bring him to\r\ntrial in the United States. If Brazil chooses not to extradite, the hacker may still face legal consequences within\r\nBrazil, depending on the country’s own laws regarding cybercrime.\r\nNevertheless, his stated intention to leave the cybercrime world and pursue a positive path for Brazil could also\r\ninfluence how authorities handle his case, potentially leading to a focus on rehabilitation rather than severe\r\npunishment.\r\nhttps://hackread.com/usdod-hacker-ssn-leak-reveals-brazilian-citizen/\r\nPage 2 of 3\n\nEditor’s Note: This article presents the USDoD hacker’s perspective. We have reached out to CrowdStrike for\r\ntheir response and will update the article accordingly once and if we receive their statement.\r\n1. Australian Man Arrested for “Evil Twin” Wi-Fi Scam\r\n2. Alleged ShinyHunters Hacker Group Member Arrested\r\n3. Feds Bust N. Korean Identity Theft Ring Targeting US Firms\r\n4. MIT Graduate Brothers Arrested for $25 Million Ethereum Heist\r\n5. Alcasec Hacker, aka “Robin Hood of Spanish Hackers,” Arrested\r\nSource: https://hackread.com/usdod-hacker-ssn-leak-reveals-brazilian-citizen/\r\nhttps://hackread.com/usdod-hacker-ssn-leak-reveals-brazilian-citizen/\r\nPage 3 of 3", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://hackread.com/usdod-hacker-ssn-leak-reveals-brazilian-citizen/" ], "report_names": [ "usdod-hacker-ssn-leak-reveals-brazilian-citizen" ], "threat_actors": [ { "id": "c071c8cd-f854-4bad-b28f-0c59346ec348", "created_at": "2023-11-08T02:00:07.132524Z", "updated_at": "2026-04-10T02:00:03.422366Z", "deleted_at": null, "main_name": "ShinyHunters", "aliases": [], "source_name": "MISPGALAXY:ShinyHunters", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "6f7f2ed5-f30d-4a99-ab2d-f596c1d413b2", "created_at": "2025-10-24T02:04:50.086223Z", "updated_at": "2026-04-10T02:00:03.770068Z", "deleted_at": null, "main_name": "GOLD CRYSTAL", "aliases": [ "Scattered LAPSUS$ Hunters", "ShinyCorp", "ShinyHunters" ], "source_name": "Secureworks:GOLD CRYSTAL", "tools": [], "source_id": "Secureworks", "reports": null }, { "id": "80edca9f-dcd6-491e-92f3-87ad1f575631", "created_at": "2023-10-14T02:03:14.694988Z", "updated_at": "2026-04-10T02:00:05.021046Z", "deleted_at": null, "main_name": "NetSec", "aliases": [ "NetSec", "Operation Data Breach", "ScarFace_TheOne", "USDoD" ], "source_name": "ETDA:NetSec", "tools": [], "source_id": "ETDA", "reports": null }, { "id": "82a51997-1402-41c3-86df-6f9e522b2ba8", "created_at": "2024-04-27T02:00:03.554045Z", "updated_at": "2026-04-10T02:00:03.63698Z", "deleted_at": null, "main_name": "USDoD", "aliases": [], "source_name": "MISPGALAXY:USDoD", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "d8dff631-87b0-4320-8352-becff28dbcf1", "created_at": "2022-10-25T16:07:24.565038Z", "updated_at": "2026-04-10T02:00:05.034516Z", "deleted_at": null, "main_name": "ShinyHunters", "aliases": [], "source_name": "ETDA:ShinyHunters", "tools": [], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434516, "ts_updated_at": 1775826716, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/50b9b57f069ba7a76d3a933fce7ea3f8e5b660eb.pdf", "text": "https://archive.orkl.eu/50b9b57f069ba7a76d3a933fce7ea3f8e5b660eb.txt", "img": "https://archive.orkl.eu/50b9b57f069ba7a76d3a933fce7ea3f8e5b660eb.jpg" } }