Entire population of Brazil possibly exposed in massive data leak

Entire population of Brazil possibly exposed in massive data leak

Pierluigi Paganini
January 10, 2024

The private data of hundreds of millions of Brazilian individuals were publicly accessible to threat actors, putting individuals at risk.

Cybernews research revealed a publicly accessible Elasticsearch instance, which contained a staggering amount of private data belonging to Brazilian individuals.

Elasticsearch is a commonly used tool for the search, analysis, and visualization of large volumes of data. The leaked data was not linked to a specific company or organization, preventing Cybernews from identifying the source of the leak.

The cluster, located on a cloud server, contained the data with full names, dates of birth, sex, and Cadastro de Pessoas Físicas (CPF) numbers. This 11-digit number identifies individual taxpayers in Brazil.

The leaked data contained more than 223 million records, which implies that the entire Brazilian population might be affected by the leak.

While the data is no longer publicly available, in the hands of a malicious actor, the exposed data could have been misused for identity theft, fraud, and targeted cybercrimes. This could have resulted in financial losses, unauthorized access to personal accounts, and other severe consequences for the individuals affected.

The massive scale of the leak amplifies the potential impact. Previously, Cybernews reported massive leaked data sets allegedly belonging to governmental entities being sold online.

If you want to know more about other massive data leaks take a look at the original post at CyberNews:

https://cybernews.com/security/brazil-data-leak-cpf-card/

About the author: Paulina Okunytė, Journalist at CyberNews

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Brazilian individuals data leak)

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts