In Brazil, like in most all low-income countries with relevant population, enormous personal databases are created with little or very poor attention paid to cybersecurity and data protection concerns. On 20 January, the largest personal data leakage in Brazilian history was discovered. While there is no official register of data leaks in Brazil, it is difficult to think that a wider and more detailed set of data about the entire population can be leaked let alone even exist.
The massive data sets were initially spotted by PSafe, a cybersecurity start-up, on a Dark Web forum and subsequently reported by Tecnoblog, a Brazilian tech portal. The databases available – either for free or for sale – include names, unique tax identifiers, facial images, addresses, phone numbers, email, credit score, salary and more. They exposed 223 million Brazilians. If the figure sounds odd, as the Brazilian population is only around 210 million, it is because the leaked data sets also encompass the personal data of several million deceased individuals. 104 million vehicle records are also available.
The fact that much information included in the leak is typically used by credit scoring bureaus, together with the enormous extension of the databases has led many observers to suspect the leak may have originated from Serasa Experian, the leading Brazilian credit-scoring bureau. At this stage, however, this supposition has not been confirmed by any official investigation, while Serasa denies that the leakage originated from its system.
A condensed version of the datasets is offered for free on a Darknet forum. An even more pervasive database, including 14 Gigabit of almost any thinkable information about every single Brazilian individual, enterprise and vehicle is currently on sale.
The free version includes “only” full name, unique tax identifier, called “CPF”, date of birth and gender of all 223.74 million individuals. The Brazilian tech portal reported that the link to download the data set has even been indexed by Google Search and access to shady Dark Web areas is not even essential to find it.
Those interested in the complete package must spend between $ 0.075 and $ 1 per individual. The amount depends on the quantity of data you are interested in purchasing. The more you buy the better the discount you can get. Data are sold in packages starting at $ 500 and payments can be executed in Bitcoin only.
The 37 bases on sale include literally all types of personal data you may think of, plus many you are not really thinking about. These include ID number, marital status, and list of all first-degree relatives (parents, son or daughter, siblings, spouse), complete home address (including latitude and longitude), credit score, voter registration number, profession, and even link to LinkedIn profile.