KromSec downloaded the data from the Iranian Ministry of Cooperation

On 6 December 2022, the hacktivist group KromSec, which had previously been involved in numerous anti-imperialist cyber operations, including in Ukraine, claimed to have downloaded the database of the Iranian Ministry of Cooperation, Labour and Social Welfare. The data reportedly contains personal information such as login, name, email, password, location, etc. Although not specified, it is likely that this attack is politically motivated due to the Iranian government's repression of its population.  

Read more about it : here