Caixa Vida e Previdência (CVP), the pension and life insurance company in the group of Brazil's state-owned bank Caixa Econômica Federal, has confirmed that attackers got into its systems and copied its customer database out of the company. Its listed parent, Caixa Seguridade (B3: CXSE3), disclosed the breach on Thursday 12 November in a notice to the market filed with Brazil's securities regulator, the CVM. The company says the stolen database covers all 7.6 million of its active customers as well as former customers. Every record holds a name and a CPF, Brazil's individual taxpayer number, and some also hold an address, phone number, email address and date of birth. No attacker has been named and no group has publicly claimed the attack.
What Happened
The company's notice gives this timeline:
- 6 November (Friday): CVP found that it had been the victim of unauthorised access and that personal and registration data had been copied out of its systems.
- 11 November (Wednesday): CVP reported the incident to Brazil's data protection authority (ANPD) and other relevant authorities under Brazil's data protection law, the LGPD. Finance News, quoting the notice, reports that affected customers were also notified that day.
- 12 November (Thursday): Caixa Seguridade published the notice to the market.
That is five days from detection to the regulator report and six days to public disclosure. G1 pointed out that the incident was "only" made public on 12 November, nearly a week after it was found.
According to the notice, CVP identified and blocked the methods the attackers used, added further protective measures, and brought in an outside forensic firm to work out the origin, scope and impact of the breach. The company is also watching the internet for signs that the data has been published. Caixa Seguridade says it will keep the market informed.
Not every affected person is being contacted directly. The notice says CVP is prioritising customers whose mobile phone numbers or email addresses were exposed, along with "vulnerable groups", and is giving them advice on avoiding fraud. It has also set up a dedicated email address for customer questions. R7 notes that the company has not published that address in its public statements.
On the same day, G1 reported that Caixa's Pix instant payment service was unstable, with more than 1,000 complaints logged on Downdetector. G1 says nothing so far links the outage to the cyberattack, and no other outlet has connected the two.
What Was Taken
The company's own description of the stolen data:
- In every record: full name and CPF number.
- In some records: postal address, phone number, email address and date of birth.
- Not taken, according to the preliminary investigation: financial or login data, which the company lists as policy values, pension balances, bank details and passwords.
On the number of people affected, the reporting is less clear than the headlines suggest. Most coverage, including VEJA, R7 and CyberSIXT, describes the breach as affecting 7.6 million customers. The notice itself, as quoted by Finance News and InfoMoney, is worded differently. It says the copied database "includes customers and former customers," and that this "covers all of its 7.6 million active customers." On that reading, 7.6 million is the number of active customers in the file, and former customers come on top of it. The company has not said how many former customers are included, so the total number of people affected may be higher than 7.6 million. Estadão's Broadcast service, published by Viva, says "up to 7.6 million". That phrasing is probably too low if former customers are counted. Until the company publishes a full total, readers should treat 7.6 million as the minimum.
The company also has not said how many records contain the extra contact details. That number matters for estimating fraud exposure, because those are the customers who can be reached directly by phone or email.
Why It Matters
Name plus CPF is the core identity pair in Brazil. People use it to open accounts, verify themselves to call centres and access government services. Add a date of birth, phone number and email, and a criminal has a ready-made kit for convincing impersonation. On top of that, the victims are known to hold pension or life insurance products with a Caixa company. Scammers can use that fact to build believable stories: a pension "portability" offer, a fake benefit payout, an "update your registration" request, or an alert about this very breach.
Luiz Augusto D'Urso, a lawyer who teaches digital law at FGV, told Times Brasil (CNBC's licensee in Brazil) that the main danger is social engineering. Criminals combine records from different leaks so their approaches look more convincing, and AI is making fraud gangs faster at producing those approaches. He said the risk does not end with the intrusion: "The criminal can extort, can leak, and worse, gangs will use this information for new scams directly against the consumer." Broadcast/Viva quotes the company itself warning that the exposed data could be used for SMS and email phishing.
For defenders, the incident is another example of a pattern seen across many sectors: a customer database, rather than a payments system, is the target, and a non-banking subsidiary of a large financial group is the point of entry. Insurers and pension providers hold detailed long-term customer records, but they usually get less attention than the core bank.
The ANPD has been notified. Neither the ANPD nor any other regulator has said anything publicly about the case so far.
The Attack Technique
How the attackers got in has not been disclosed. The company says only that there was "unauthorised access" and that data was copied "out of its technological environment", and that the "mechanisms" used in the attack have been identified and blocked. It has not said whether the cause was stolen credentials, a vulnerable internet-facing application, a third-party supplier or something else. It has also not said whether ransomware was involved.
No ransom demand has been reported, no group has claimed the attack, and none of the coverage reports the data being offered for sale or posted on a leak site. The company's ongoing monitoring of the internet suggests it is preparing for that possibility. The external forensic investigation is still running, and Caixa Seguridade has said it will update the market. Its next notice is the place to look for any explanation of how the attack worked.
What Organizations Should Do
- Expect fraud using the Caixa name and pension products. Brazilian banks, insurers, pension managers and fintechs should tell fraud and contact-centre teams to watch for social engineering that refers to Caixa Vida e Previdência, pension transfers or breach "compensation". Name, CPF and date of birth should not be enough to verify anyone, because those details are now in criminals' hands for millions of people.
- Tighten customer verification. Anything that unlocks an account or changes contact or payment details with only a CPF and date of birth should require a second factor that is not in this dataset, such as an app-based confirmation or a one-time code sent to an existing registered device.
- Watch who and what can read the customer database in bulk. Watch for large reads, unusual exports and big outbound transfers from CRM and policy administration systems. Bulk copying of a full customer table should set off an alert within minutes, not be found later. Limit service and user accounts to the records they actually need.
- Bring subsidiaries and joint ventures under group security standards. Insurance, pension and other investee companies inside financial groups should meet the same requirements as the core bank for access logging, data loss prevention, privileged access management and incident response.
- Prepare notification and customer communications before an incident. Have a published, checkable support channel ready. Choosing not to publish one makes it harder for customers to tell the real channel from a fake one. Plan for notifying everyone affected, not only those with contact details on file.
- Tell your own staff and customers. CPF numbers are likely to be shared among employees and customers of many Brazilian organisations. Warn them about urgent calls or messages claiming to be from Caixa, and tell them to check any request only through official channels they find themselves.
Sources: Caixa Vida e Previdência breach exposes data of 7.6 million customers | Ataque hacker à Caixa Vida e Previdência expõe dados pessoais de cl... | Caixa Vida e Previdência identifica vazamento de dados de 7,6 milhõ... | Vazamento na Caixa abre caminho para golpes personalizados - Times... | Caixa Seguridade: Caixa Vida e Previdência informa sobre incidente... | Caixa Vida e Previdência tem dados vazados de 7,6 milhões de clientes | Ataque hacker expõe CPFs de 7,6 milhões de clientes da Caixa; veja... | Entenda o ataque hacker à Caixa Vida e Previdência que vazou dados...