Brazil's biggest data breaches and what happened next

From the 223 million CPF mega-leak to Pix keys, iFood and Cemig: Brazil's largest public data breaches and what happened after each case was revealed.

2026-10-22

Name, taxpayer number, address, income, credit score: for many Brazilians, this information has already circulated in at least one breach. That is why fraudsters can call victims quoting real details. Here are some of Brazil's largest public cases and what happened next.

The 2021 mega-leak

In January 2021, PSafe's dfndr lab revealed the exposure of data linked to more than 223 million CPF numbers (including deceased people) and over 40 million company IDs, with names, addresses, income, tax data, photos and credit scores (O POVO). On 19 March 2021, the Federal Police's Operation Deepwater arrested a suspect in Uberlândia. In December 2023, federal prosecutors sought a fine of at least R$200 million against Serasa and R$30,000 per affected person; Serasa says its systems were not breached and that there is no evidence the data came from its databases (Mercado & Consumo). The origin of the leak has never been publicly established.

Pix keys

In March 2026, the Central Bank reported a leak of registration data tied to 28,203 Pix keys held by Pefisa, the Pernambucanas group's financial arm, exposed between August 2025 and February 2026 (Olhar Digital). It was the 23rd Pix key incident since the system's launch in November 2020 (Portal de Prefeitura). Such data cannot be used to move money, but they are what scammers need to impersonate a bank.

Recent corporate cases

iFood: in June 2026 it confirmed a December 2025 incident exposing names and CPFs of about 1.2 million users; it did not notify users, saying its assessment under ANPD criteria found no relevant risk (BNews).
Cemig: in May 2026 the utility reported unauthorised access exposing data of about 135,000 customers and notified the ANPD, the electricity regulator and police (Investidor10).
MedicSolution: in September 2025 the KillSec group claimed theft of more than 34 GB of patient exams and images from misconfigured cloud storage (Convergência Digital).

In the Cemig case, the exposed data included customers' parents' names, address, email, phone and invoice amounts; the company said access was blocked soon after detection and began notifying customers individually. In the Pefisa case, the Central Bank stressed that passwords, balances and statements were not exposed, that it would never contact customers by phone, SMS or email about the incident, and that it opened an investigation that could lead to sanctions (Olhar Digital).

What the law requires

Under ANPD rules, controllers must notify the authority and data subjects within three business days when an incident may cause relevant risk or harm, and log all incidents for five years (Cescon Barrieu). The iFood case shows how much the "relevant risk" test leaves to companies' own judgement.

If your data leaked

Assume fraudsters know your details and distrust callers who quote them.
Use the Central Bank's BC Protege+ and Registrato services to block and check accounts in your name.
Change passwords and turn on two-factor authentication.
Ask the company what data were affected and complain to the ANPD if it does not respond.