National Treasury identifies improper access to data from 30 thousand registrations and 4 thousand PIX keys
Incident exposed CPF, emails and Pix keys; agency states that there was no financial impact
Quick Look
- The National Treasury confirmed a leak of data from e-Serviços users and an internal analytical base, exposing names, CPFs, emails and Pix keys of recipients of federal payments.
- The agency states that there was no financial impact and that the structuring systems were not affected.
AI-generated summary
Why It Matters
The National Treasury identified and contained improper access to two databases. One of them is the e-Services portal, used to request and monitor services offered by the agency. The other is a base used for internal analytical queries.
In the case of e-Serviços users, data such as name, Individual Taxpayer Registry (CPF) and email address registered on the platform were improperly accessed. The portal is used to request and monitor services offered by the National Treasury.
In the other affected base, used for internal analytical consultations, Pix keys of recipients of federal government payments and information related to the transactions carried out were exposed.
According to the Treasury, the accessed data can be used by third parties to make fraudulent contacts more convincing. This means that criminals can, for example, use a person's true information to try to impersonate public institutions or bodies and trick them into providing passwords, other personal data or making payments.
Therefore, the agency recommends paying attention to suspicious messages and contacts, especially those that request personal information, passwords or money transfers.
The National Treasury stated that the incident had no financial impact and did not affect any of its structural systems.
According to the agency, security mechanisms and network monitoring made it possible to identify and contain improper access. After identifying the problem, monitoring mechanisms were reinforced and additional protection measures were implemented.
Open Questions
- How many users were affected by the leak?
- When exactly did the unauthorized access occur?
- Who is responsible for the attack?
- What additional protective measures have been implemented?
