Caixa Vida e Previdência breach exposes data of 7.6 million customers

Caixa Vida e Previdência, the pension and life insurance company in the group of Brazil's state-owned bank Caixa Econômica Federal, says attackers copied its customer registration database, exposing the names and CPF tax numbers of all 7.6 million of its active customers as well as former customers. Its listed parent, Caixa Seguridade, disclosed the breach in a notice to the market on Thursday.

According to the notice, the company found on 6 November that it had suffered unauthorised access and that personal and registration data had been copied out of its systems. Some records also included addresses, phone numbers, email addresses and dates of birth. Based on its preliminary assessment, the company says there is no evidence that financial or authentication data was taken, such as policy values, pension balances, bank details or passwords.

Six days from detection to disclosure

The company reported the incident to Brazil's data protection authority, the ANPD, other authorities and affected people on 11 November, five days after finding it, and Caixa Seguridade told the market a day later. It says it identified and blocked the methods used in the attack, added protective measures and hired an outside forensic firm to establish the origin and scope of the breach. It is also monitoring the internet for signs that the data has been published.

Not every affected customer is being contacted directly. The notice says the company is notifying people whose mobile phone numbers or email addresses were exposed, along with vulnerable groups, and giving them advice on fraud. It has set up a dedicated email address for questions. In the message sent to customers, reported by Folhapress, the company said it had so far seen no evidence that the data had been published or misused, but warned it could be used in attempts to impersonate the company or other institutions.

What it means for customers

The exposed fields are enough to make a call or message look official. The company's own warning points to people posing as Caixa Vida e Previdência to obtain more information. Customers should treat unexpected contact about their policy or pension with suspicion and verify it through the company's official channels.

What is not known

The company has not said how the attackers got in, how many former customers are affected beyond the 7.6 million active ones, or whether anyone has claimed the attack. Caixa Seguridade's investor relations page says it will keep the market informed of material developments.