Caixa insurer breach leaks names and tax IDs of all 7.6 million customers
Brazil's Caixa insurer breach exposes names and tax IDs of all 7.6M customers
Caixa Vida e Previdência, a subsidiary of Caixa Seguridade, told Brazil's data protection authority that attackers copied personal data out of its systems on November 6, 2026. Names and CPF taxpayer numbers from its registration database were exposed for all 7.6 million active customers, plus some former ones; some records also held addresses, phone numbers, emails and birth dates. The company says no financial or authentication data was compromised.
The analyses conducted to date have confirmed the exposure of names and CPF numbers from CVP's registration database, which includes both current and former customers and covers all of its 7.6 million active customers.
- afh1
No financial information leaked, just tax id, which in Brazil nowadays doesn't mean much. There have been more than one high profile website in the past reportedly selling personal data, including tax identifier (CPF), for essentially any Brazilian citizen.
It is common to be asked for your CPF for trivial things like purchasing anything on a drugstore, and for any and all activity with government branches or banking. This combined with several breaches in government and private institutions in Brazil over the years has made this information essentially public.
More concerning is when more private information is leaked. For example, police security camera live feed and license plate or CPF-based tracking of anyone was sold online in the past, and has been used by criminal gangs in an attempted murder of a judge: https://www.poder360.com.br/justica/pcc-tinha-acesso-a-siste...
This highlights the importance of reducing the amount of data collected, but in Brazil and the rest of the world, both governments and private institutions have pushed for the contrary, more so in recent years.
- yakkomajuri
I'm pretty sure at this point every tax ID (CPF) in Brazil is available on a database you can get on the dark web.
We've had a "CPF-ication" of everything in Brazil over the last few years. The vast majority of people have shared this number with their local grocery store, pharmacy, gym, etc. It's required for a lot of stuff and pretty necessary for others.
Given that, if that's all that leaked here that's a pretty good outcome. It's sad that I think like this but it's kind of how it is.
What makes me more pessimistic is that they claim no financial data was exposed but I wonder if that's really true. And that's where the gold is because then scammers know who to target.
- cesarb
For those who don't know it, our tax id (CPF) is basically public information. For instance: we just had an election. The official public site with the official information about all the candidates (https://divulgacandcontas.tse.jus.br/) has the CPF for all of them. Want to know our president's CPF? It's there.
The bad part is the rest. Having the name together with the phone number, plus being on the list meaning you most likely have one of a particular set of products from Caixa, makes it much easier for the scammers to pretend to be from the bank.
- goshx
Small potatoes. CPFs have been leaked so many times in Brazil that probably all of them are already out there. [0][1][2]
[0] https://cyberbrics.info/the-largest-personal-data-leakage-in...
[1] https://www.bitdefender.com/en-us/blog/hotforsecurity/massiv...
[2] https://www.lumiun.com/blog/en/data-breach-in-brazil-the-wor...
- airstrike
It's important to note the Brazilian tax id (CPF) is not meant to be a well kept secret like the American SSN