Police arrest hacker suspected of biggest data leak in BrazilPolice arrest hacker suspected of biggest data leak in Brazil

In January 2021, Brazilian security lab dfndr lab, operated by the firm PSafe, found datasets for sale on criminal forums that appeared to cover almost the entire population of Brazil. The files listed about 223 million CPF numbers, the country's individual taxpayer identifier, along with full names and dates of birth. Because the total exceeded Brazil's population of about 212 million, researchers concluded that records of deceased people were included.

The free sample was only the start. Sellers offered paid add-ons containing far more sensitive details, including addresses, phone numbers, email addresses, photos, income, credit scores, tax filings, and information on beneficiaries of the Bolsa Familia welfare program. Separate files reportedly contained data on about 104 million vehicles and information on companies. Buyers were asked to pay in cryptocurrency.

The origin of the data was never fully settled. Some fields resembled products sold by credit bureau Serasa Experian, prompting inquiries by consumer protection agencies and Brazil's newly created National Data Protection Authority, known as ANPD. Serasa denied that its systems had been breached. Experts said the trove was likely assembled from multiple leaks over years.

In March 2021, Brazil's Federal Police launched Operation Deepwater, arresting a suspect in Uberlandia, Minas Gerais, accused of acquiring and selling the data, and identifying a second suspect who allegedly advertised it on social media. The warrants were issued by Supreme Court Justice Alexandre de Moraes.

The incident arrived just months after Brazil's general data protection law, the LGPD, took effect, and it became an early test for the ANPD. For ordinary Brazilians, the combination of CPF numbers, which are required for banking, shopping and government services, with income and credit data created long-term risks of identity fraud and targeted scams. It remains one of the largest exposures of national identity data outside Asia. Brazil has since seen repeated mass exposures, including a 2024 discovery by researchers of an unprotected database listing names, birth dates and CPF numbers for roughly 223 million people, underscoring how widely identity data now circulates. Security experts advise Brazilians to monitor their credit reports and treat unsolicited calls that cite their CPF with suspicion.