Open-source inventory of cybersecurity incidents affecting Peruvian public entities (2020-2026)

An open-source intelligence (OSINT) inventory of publicly reported cybersecurity incidents affecting Peruvian government (.gob.pe) and defence (.mil.pe) entities between 2020 and 2026. Every record is traceable to a public source: institutional communiques, CNSD/PECERT security alerts, administrative resolutions, presentations to Congress, investigative journalism, threat-actor claims and third-party technical analyses. The inventory comprises three distinct record sets: 101 public records (C identifiers) documented in public sources; 303 historical defacement records (Z identifiers) drawn from 13 non-consecutive archive pages of Zone-H; and 282 consolidated, normalised hostnames resolved from both sets, which map to 170 distinct institutional domains. These counts describe different units and overlap. They are not additive: 101 plus 303 does not equal 404 attacks, and 282 hosts does not equal 282 confirmed compromises. The dataset records what was reported, which entity it was linked to, and what limits the evidence retains. Evidence states are preserved rather than resolved: 74 of the 101 public records carry data leakage as not substantiated; conflicting threat-actor attributions are retained as reported; and data volumes claimed by attackers are labelled as claims, not facts. A publication or disclosure date is not treated as an intrusion date. Known limitations are documented in full. The inventory is not a census of incidents in Peru, and the absence of an entity does not prove that no incident occurred. Coverage is temporally skewed: 60 of the 101 public records fall in 2020, which reflects available source coverage rather than national incidence. The Zone-H records are a convenience sample of historical defacement, not a random one. Domains relate entities to incidents but do not identify the point of intrusion; in several cases the affected system was an internal network, institutional email or a named service rather than the public portal. Domains under .edu.pe are excluded. Files are provided as UTF-8 CSV with an accompanying data dictionary, as the complete original workbook, and as an analytical report containing the findings, the method and full annexes. Source hyperlinks embedded in the original workbook have been extracted into explicit URL columns so that traceability survives the CSV conversion. The dataset consolidates information that was already public at the time of compilation. It contains no vulnerability details, proof-of-concept code, credentials or unpublished findings. Users are asked to treat it as research material, to prefer aggregate or sector-level reporting over nominal rankings of compromised institutions, and to report any independently discovered weakness to the affected entity and to Peru's Centro Nacional de Seguridad Digital through its published channels, in line with ISO/IEC 29147:2018.