Executive Summary

Chronus Team published a message claiming to have exposed information linked to Argentina’s Dirección Nacional de los Registros Nacionales de la Propiedad del Automotor y de Créditos Prendarios — DNRPA. In the publication, the actor uses as a sample a record attributed to President Javier Milei, including personal and vehicle-related data, and presents the material as part of a leak of approximately one million rows.

The forensic review of the downloadable file makes it possible to qualify that narrative. The link exposed by Chronus Team allows the download of a ZIP file named DNRPA.zip, which contains two files: DNRPA.sql and DNRPA.db. However, both files do not constitute independent samples: they are byte-for-byte identical, have the same size, CRC and SHA-256, and contain the same SQLite database. The file named .sql does not correspond to a plain-text SQL dump, but to a valid SQLite 3 database saved with an incorrect extension.

The analyzed content does show high structural potability. The database is intact, queryable and contains a single table with 706,464 active rows, 704,588 unique identifiers and more than 500,000 distinct domains. It also includes records dated up to July 27, 2026.

However, the “1 million rows” statement does not hold in a literal sense against the active database analyzed. In addition, the sample attributed to President Javier Milei is not supported by the two provided artifacts: the central indicators publicly disclosed by the actor were not found in the active rows or in the general review of the file, and the database schema does not contain specific columns compatible with several of the fields used in the presidential sample.

Key Judgments

• Chronus Team published a declared leak linked to DNRPA and used a sample attributed to President Javier Milei as an element of high political and media impact.
• The analyzed downloadable material appears structurally potable: it contains a valid, intact and queryable SQLite database with a significant volume of coherent information.
• The active database contains 706,464 rows, not one million rows. The figure communicated by the actor may reflect promotional simplification.
• The characterization of the leak as a general registry of vehicle owners and vehicles does not match the observed structure. The content is mainly related to notarial authorizations involving vehicles, owners, authorized persons and vehicle domains.
• The presidential information published by Chronus Team through a message is not present in the analyzed artifacts and cannot be validated against the delivered database. This does not prove that the information is false, but it does make it possible to state that it is not supported by the reviewed downloadable files.

What Happened

Chronus Team published a piece titled “Chronus Leaks” mentioning Argentina’s Dirección Nacional de los Registros Nacionales de la Propiedad del Automotor y de Créditos Prendarios — DNRPA. The message claims the existence of a database with “1 Million” rows and provides a download link.

As a public sample, the actor displays data attributed to President Javier Milei, presented as vehicle-related information extracted from the alleged leak. The publication uses that example to maximize visibility, political sensitivity and perception of impact.

The downloadable file contains a ZIP named DNRPA.zip with two internal files: DNRPA.sql and DNRPA.db. The forensic analysis indicates that both files are the same artifact with different extensions. The decompressed database is approximately 569.36 MB and passes basic integrity verification.

The database contains a single table named DNRPA, with 17 columns and 706,464 active rows. It also contains 704,588 unique identifiers, 1,876 exact duplicate rows, 506,968 distinct values in the domain field and 541,703 distinct normalized license plates after separating records containing multiple domains.

The observed structure does not correspond to a complete general registry of owners and vehicles. The fields are mainly related to notaries, notarial registration and status, notarial registries, authorized persons and their documents, domains or license plates, authorizations to drive or export, validity, issuance and expiration dates, and administrative observations.

Preliminary Forensic Assessment

The analyzed database presents relevant signs of structural authenticity. There are records dated July 2026 and a most recent issuance date of July 27, 2026. This suggests that the material contains recent data or entries close to the publication date, although it does not determine when the extraction occurred or whether all the data came from a single incident.

The database also presents anomalies related to sentinel values, malformed entries, fields with a high proportion of N/A, records that appear incomplete or test-like, and a large number of internal SQLite pages marked as free.

The presidential sample is the most delicate point. The analyzed files do not make it possible to confirm that the leak contains the data published by Chronus Team about Javier Milei. The central indicators disclosed in the public sample were not found in the active rows or in the general review of the file. In addition, the database schema does not contain specific columns for several of the elements presented in the publication, such as CUIT, locality, make, model, vehicle year or registration date.

Therefore, the most defensible statement is that the presidential sample published by Chronus Team is not present in the provided artifacts and cannot be validated against the analyzed downloadable database. It could derive from a separate undisclosed dataset, an external source, or a manually constructed promotional record.

Operational Assessment

Chronus Team appears to be using a combination strategy: a structurally potable file, an inflated or imprecise description, and a high-impact political sample that is not supported by the delivered artifacts. That combination maximizes public attention and complicates a quick reading. The real material provides initial credibility; the presidential sample adds impact; the difference between the two requires forensic validation.

The use of data attributed to the President of Argentina serves an evident narrative function. It inserts the leak into a political dimension, raises media sensitivity and allows the actor to present the exposure as a national or institutional security failure. However, the lack of correspondence between the sample and the analyzed database reduces confidence in that specific part of the message.

Intelligence Significance

Chronus Team’s publication is relevant for three reasons.

First, the downloadable artifact has value. The database is valid, queryable, apparently recent and contains a significant volume of coherent data associated with notarial authorizations, vehicle domains and authorized persons. This suggests that the actor has, at a minimum, structured material and not a complete fabrication.

Second, the public narrative is imprecise. The database does not contain one million active rows and does not correspond to a complete general registry of vehicle owners. The actor’s description simplifies or exaggerates the scope of the material.

Third, the presidential sample is not supported by the analyzed files. That disconnect is central because it shows how Chronus Team relies on a real artifact to introduce a higher-impact political sample that does not necessarily come from the same public dataset.

For CTI, institutional response and data protection teams, the case requires a two-track approach: validating the real exposure of the artifact and, separately, verifying the origin of the presidential sample.

Analytical Closing

Chronus Team published an alleged DNRPA leak and used a sample attributed to President Javier Milei as a high-impact element. The forensic analysis of the downloadable file confirms the existence of a valid, intact, significant-volume and queryable SQLite database.

However, the analyzed material does not support the actor’s full narrative. The “1 million rows” statement does not match the 706,464 observed active rows, the database structure is better aligned with notarial vehicle authorizations than with a general owner registry, and the presidential sample does not appear in the provided artifacts.

iQBlack assesses the case as a leak with structurally potable material, but accompanied by an imprecise narrative. The sample attributed to Javier Milei is treated as not validated against the public downloadable database.