Massive Data Breaches Hit Caixa Vida e Previdência and Tesouro Nacional

Overview

• Caixa Vida e Previdência detected an unauthorized access on Friday, Nov. 6 that resulted in the copying of personal and cadastro data for its full 7.6 million active-client base and an unspecified number of ex-clients.
• The Tesouro Nacional found an earlier access on Nov. 4 that exposed about 30,000 e-Serviços cadastros and roughly 4,000 Pix keys for government payment beneficiaries.
• Both organizations say they blocked the attack vectors, engaged external forensic consultants to investigate origin and scope, and notified the Autoridade Nacional de Proteção de Dados and other competent authorities in the required timeframes.
• Companies report no confirmed compromise of financial credentials or authentication data so far and are notifying customers whose phone numbers or emails were exposed with concrete guidance to avoid phishing and impersonation scams.
• Authorities are monitoring a cluster of early-November cyber incidents that also affected other institutions such as the Port of Santos, heightening scrutiny of sector cybersecurity and increasing the risk of targeted fraud against affected individuals.