No financial information leaked, just tax id, which in Brazil nowadays doesn't mean much. There have been more than one high profile website in the past reportedly selling personal data, including tax identifier (CPF), for essentially any Brazilian citizen.
It is common to be asked for your CPF for trivial things like purchasing anything on a drugstore, and for any and all activity with government branches or banking. This combined with several breaches in government and private institutions in Brazil over the years has made this information essentially public.
More concerning is when more private information is leaked. For example, police security camera live feed and license plate or CPF-based tracking of anyone was sold online in the past, and has been used by criminal gangs in an attempted murder of a judge: https://www.poder360.com.br/justica/pcc-tinha-acesso-a-siste...
This highlights the importance of reducing the amount of data collected, but in Brazil and the rest of the world, both governments and private institutions have pushed for the contrary, more so in recent years.
> It is common to be asked for your CPF for trivial things like purchasing anything on a drugstore
I always point out how insane this is to my Brazilian friends but then I, as a foreigner, have to hand over my passport number instead for the same inane things. I ended up getting a Brazilian eSim and now get spam calls all day.
No, this is very serious. Scammers now have a list of people who have/had life insurance with Caixa.
It doesn’t matter if no other information is leaked, the mere fact that you appeared in this list is financial data about you.
Also, Caixa admits the leak affected all of their insurance customers. So even if you are not on the list, scammers now know one more thing about you. This is bad.
> just tax id, which in Brazil nowadays doesn't mean much
Fraudsters can go as far as opening bank accounts with that information, take loans an disappear, I don't know what you mean with "doesn't mean much". Not every brazilian is in "BC Protege", which would prevent this.
Also the fact that it has been leaked before does not diminish what has happened here, maybe the new bad actors did not have access to previous information.
But who would be affected, the institutions or the actual customers whose information was leaked? Any fraudulent activity based on the leaked information cannot be directly blamed on the customers themselves and should be a problem the institutions to be stuck with and solve.
People are seriously underestimating the impact of these leaks.
I've had government websites authenticate me by CPF and birth date on my first login. These government people made this and thought there was nothing wrong with it, it's literally in production right now.
Learn from Brazil, folks. Brazilian terrorists managed to get access to the mass surveillance system. I literally cannot think of a better argument against mass surveillance.
> both governments and private institutions have pushed for the contrary, more so in recent years.
Yeah...
Brazil in particular will only ever double down on totalitarianism. If people are stepping out of line so brazenly like that, then clearly it's because the boot of the state isn't stepping on their faces hard enough. Lula's government is on the record praising "the chinese model".
Gonna need more surveillance, more data collection, more vague and expansive laws, more judicial activism, more everything.
Lula's opposition would do the same (Bolsonarists and non-Bolsonarists). Brazil is not Sweden. Country for the common man is so shit that nobody cares.
I'm pretty sure at this point every tax ID (CPF) in Brazil is available on a database you can get on the dark web.
We've had a "CPF-ication" of everything in Brazil over the last few years. The vast majority of people have shared this number with their local grocery store, pharmacy, gym, etc. It's required for a lot of stuff and pretty necessary for others.
Given that, if that's all that leaked here that's a pretty good outcome. It's sad that I think like this but it's kind of how it is.
What makes me more pessimistic is that they claim no financial data was exposed but I wonder if that's really true. And that's where the gold is because then scammers know who to target.
Even if no financial data was exposed, scammers now know these people have/had life insurance with Caixa, which is enough to make them preferred targets and to make scams more convincing.
Until recently Brazil had no unified national ID document. Each state had theirs. It was possible to have IDs from more than one state. As the tax ID was unique for the whole country, people started using it as unique identifier of choice.
Both. Brazilian KYC/AML laws are based around the CPF number. It also serves corporations as a stable ID to identify people and track them. It's possible that it's a primary key in their databases.
For example, it's common to get cashback in stores in exchange for the CPF number. They track you, comply with regulations and reward you -- all with one government ID.
The American SSN was not originally meant to be secret either, nor used for identification other than for Social Security/Tax purposes.
But because it was a nationally unique number for every individual, it got used as a primary key for all sorts of other things, and it ended up becoming very sensitive.
I find it both a nerve wrecking and interesting thought experiment to assume that all data is going to leak. Could we go through this and get out alive? And, if so, what would the world look like after? It's not at all clear to me it must be worse.
The attacks started hitting Brazil, and it'll be really bad! Multiple people that uses Caixa (in general) aren't tech savvy and could be caught by fraudsters more easily.
It is common to be asked for your CPF for trivial things like purchasing anything on a drugstore, and for any and all activity with government branches or banking. This combined with several breaches in government and private institutions in Brazil over the years has made this information essentially public.
More concerning is when more private information is leaked. For example, police security camera live feed and license plate or CPF-based tracking of anyone was sold online in the past, and has been used by criminal gangs in an attempted murder of a judge: https://www.poder360.com.br/justica/pcc-tinha-acesso-a-siste...
This highlights the importance of reducing the amount of data collected, but in Brazil and the rest of the world, both governments and private institutions have pushed for the contrary, more so in recent years.
I always point out how insane this is to my Brazilian friends but then I, as a foreigner, have to hand over my passport number instead for the same inane things. I ended up getting a Brazilian eSim and now get spam calls all day.
It doesn’t matter if no other information is leaked, the mere fact that you appeared in this list is financial data about you.
Also, Caixa admits the leak affected all of their insurance customers. So even if you are not on the list, scammers now know one more thing about you. This is bad.
Fraudsters can go as far as opening bank accounts with that information, take loans an disappear, I don't know what you mean with "doesn't mean much". Not every brazilian is in "BC Protege", which would prevent this.
Also the fact that it has been leaked before does not diminish what has happened here, maybe the new bad actors did not have access to previous information.
I've had government websites authenticate me by CPF and birth date on my first login. These government people made this and thought there was nothing wrong with it, it's literally in production right now.
Paragraph 1: All CPFs have already leaked
P2: Even drugstores have your CPF
P3: The problem is if anything else leaks
Brazilian groupthink?
Learn from Brazil, folks. Brazilian terrorists managed to get access to the mass surveillance system. I literally cannot think of a better argument against mass surveillance.
> both governments and private institutions have pushed for the contrary, more so in recent years.
Yeah...
Brazil in particular will only ever double down on totalitarianism. If people are stepping out of line so brazenly like that, then clearly it's because the boot of the state isn't stepping on their faces hard enough. Lula's government is on the record praising "the chinese model".
Gonna need more surveillance, more data collection, more vague and expansive laws, more judicial activism, more everything.
But at least he was going to go after the drug trafficking terrorists. Lula just isn't going to do that.
We've had a "CPF-ication" of everything in Brazil over the last few years. The vast majority of people have shared this number with their local grocery store, pharmacy, gym, etc. It's required for a lot of stuff and pretty necessary for others.
Given that, if that's all that leaked here that's a pretty good outcome. It's sad that I think like this but it's kind of how it is.
What makes me more pessimistic is that they claim no financial data was exposed but I wonder if that's really true. And that's where the gold is because then scammers know who to target.
For example, it's common to get cashback in stores in exchange for the CPF number. They track you, comply with regulations and reward you -- all with one government ID.
[0] https://cyberbrics.info/the-largest-personal-data-leakage-in...
[1] https://www.bitdefender.com/en-us/blog/hotforsecurity/massiv...
[2] https://www.lumiun.com/blog/en/data-breach-in-brazil-the-wor...
But because it was a nationally unique number for every individual, it got used as a primary key for all sorts of other things, and it ended up becoming very sensitive.
https://news.ycombinator.com/item?id=50386104
Thoroughly embarrassing, and it's only ever going to get worse.
Caixa, although is gaining a lot of attention (government spending, bad management and etc), so it could attract more attacks than ever.
How dystopian is it to find reassuring in this situation that a customer doesn't have to wonder whether their data was leaked because it's "all"?