No financial information leaked, just tax id, which in Brazil nowadays doesn't mean much. There have been more than one high profile website in the past reportedly selling personal data, including tax identifier (CPF), for essentially any Brazilian citizen.
It is common to be asked for your CPF for trivial things like purchasing anything on a drugstore, and for any and all activity with government branches or banking. This combined with several breaches in government and private institutions in Brazil over the years has made this information essentially public.
More concerning is when more private information is leaked. For example, police security camera live feed and license plate or CPF-based tracking of anyone was sold online in the past, and has been used by criminal gangs in an attempted murder of a judge: https://www.poder360.com.br/justica/pcc-tinha-acesso-a-siste...
This highlights the importance of reducing the amount of data collected, but in Brazil and the rest of the world, both governments and private institutions have pushed for the contrary, more so in recent years.
> It is common to be asked for your CPF for trivial things like purchasing anything on a drugstore
I always point out how insane this is to my Brazilian friends but then I, as a foreigner, have to hand over my passport number instead for the same inane things. I ended up getting a Brazilian eSim and now get spam calls all day.
As I understand it's actually pretty similar to an SSN, i.e it's used for financial and government identification. When it gets used for both trivial and non-trivial things it becomes a huge vector for identity fraud.
My name, birthdate, address and contact info are all widely available online so keeping those government IDs secret is what backstops identity fraud.
In Brazil companies must have the purchaser's (natural person or company) tax ID for invoicing purposes. Point-of-sale in-person sales transactions don't require invoicing, just receipts, but any other commercial transaction does. Even returning merchandise that was bought with a receipt will require an inbound invoice and a CPF. Thanks tax evaders.
Maybe 30 years ago one could think of their CPF as a number to keep mostly private, but since a large part of the economy now goes through digital channels, a CPF is simply a person identifier rather than something secret.
Nobody trusts CPFs to be a secure identifier anymore. The backstop currently rests on biometric validation on B2C scenarios. For more secure purposes (like contracts) we have digital signatures backed by the gov.br infrastructure, which are widespread but requires acceptance by both parties, and also digital signatures backed by PKI like e-CPF and e-CNPJ that carries full validity by law and are equivalent to notarized signatures. Very few people have e-CPFs though.
You are never forced to provide your CPF for trivial things, it's completely optional and it's usually used for convenience (easier to get a refund later, for example) and even for people to get some tax discounts in some States.
I've never seen anyone showing a passport in Brazil. Though I'm Brazilian, my CPF had been cancelled after more than 10 years I didn't use it (since I haven't lived there in more than 20 years) but that never caused me any inconvenience.
Fun fact: CPF was accepted as identification to vote for President!
Signing up for most things requires a CPF, some offer a passport option but a lot don't. Trying to make a payment online is also sometimes blocked by requiring a CPF. The fact that you can vote with it is just another point for why it shouldn't be treated like an email, those cards look incredibly easy to fake.
You can't vote with just a CPF. The cards aren't issued since 2011, and they didn't have a photo or anything like that. At that time, they were considered tax identifiers only. They moved to printing the CPF number on receipt paper when somebody requested it at the post office when they reached 16-18 years old, usually at the same time when one would request their electoral registration or when requesting an employment booklet. It was a rite of passage to the adult life. More recently all newborns receive a CPF number when they are registered on their birth certificate.
In any case, you have to vote with a photo ID document and you have to scan a fingerprint that was previously enrolled in the electoral justice courts or whenever you renew a driver's license or photo ID. By now 88% of the population have their fingerprints collected for electoral purposes.
In 2023 a law was passed to deprecate state-level ID cards and numbers to use a single federal identifier, and since every economically active person in the country already had a tax ID, the government decided to use the same number.
I do think they cause unnecessary friction for non-residents though, because companies could simply accept passport numbers, as authorized by tax law, but I guess nobody gives this a thought.
As a tourist a few years ago I needed to provide a CPF to buy soccer tickets online in Sao Paulo. Intercity busses also required one to book online. Neither accepted anything else like a passport. It was... inconvenient and not optional for those things!
No, this is very serious. Scammers now have a list of people who have/had life insurance with Caixa.
It doesn’t matter if no other information is leaked, the mere fact that you appeared in this list is financial data about you.
Also, Caixa admits the leak affected all of their insurance customers. So even if you are not on the list, scammers now know one more thing about you. This is bad.
> just tax id, which in Brazil nowadays doesn't mean much
Fraudsters can go as far as opening bank accounts with that information, take loans an disappear, I don't know what you mean with "doesn't mean much". Not every brazilian is in "BC Protege", which would prevent this.
Also the fact that it has been leaked before does not diminish what has happened here, maybe the new bad actors did not have access to previous information.
But who would be affected, the institutions or the actual customers whose information was leaked? Any fraudulent activity based on the leaked information cannot be directly blamed on the customers themselves and should be a problem the institutions to be stuck with and solve.
You're not looking at the full picture. Of course customers ultimately won't be responsible. But they might have to spend weeks/months/years fighting multiple systems for those accounts/charges/debts to be removed from their names. And just when you think it's solved, there's another one! Anyone who's been through this will tell you that it's very stressful and time consuming, unfortunately.
People are seriously underestimating the impact of these leaks.
I've had government websites authenticate me by CPF and birth date on my first login. These government people made this and thought there was nothing wrong with it, it's literally in production right now.
You are likely misunderstanding what happened. Government websites usually let you use your gov.br app to authenticate and that uses your CPF as username. But it has a hardware stored certificate that identifies you, you don't need a password because it's presenting a cryptographic certificate instead, which is much, much more secure.
The Nota Fiscal website has three access methods: user/password, digital certificate and gov.br account.
I chose the user/password method, and went through their "first access" flow to set up my account. I was asked for my CPF, birth date and some other tax number I don't remember. That was it.
The "much, much more secure" option literally doesn't matter
when I can literally bypass it with birth dates and some other tax minutiae that anyone in my accountant's office can get their hands on.
My most recent interaction with a government website that did this: Nota Fiscal.
Didn't have an account, so I had to go through their "first login" flow where it demanded my CPF, birth date and some other tax number thing I don't quite remember. That's all it takes to "verify" my identity, apparently.
It's a system that rolled out nationwide some time ago. I was forced to migrate to it after my city's nota fiscal system was deprecated. Don't remember if the local system was better or worse: my accountant signed up for it, not me.
Honestly, I don't even want them to fix any of this at this point. If they try, I have no doubt they'll double down on the surveillance and mandate facial recognition instead. And when people inevitably start deep faking it with AI, I have no doubt they'll destroy computer freedom because of it by requiring that everybody be restricted to locked down government approved phones.
I imagine your voter registration. That one is a very "secretive" number, since people used to use it to commit voter fraud by the 80s and 90s.
Anyway, that's a site where you register to report and pay taxes. It's not something other people will rush to do in your name. There is usually extra security on the services that provide stuff that people actually want.
> Anyway, that's a site where you register to report and pay taxes.
No, it's a government website where you generate invoices so that other people can pay you for services rendered. Every businessman needs to deal with this bureaucracy.
> It's not something other people will rush to do in your name.
Anyone who impersonates me and gets into this system could launder money through my business.
Interesting. I also went through this sign up recently and thought it was weird that it didn’t require gov.br.
But it asked me for my voter ID and the receipt numbers of my last 2 annual tax forms, which are very secret and somewhat in line with the scope of permissions I got (read-only permissions of tax documents). Write permissions required a digital certificate.
There is a gov.br and digital certificate option, but they are not mandatory.
> the receipt numbers of my last 2 annual tax forms, which are very secret and somewhat in line with the scope of permissions I got
I see.
I wouldn't call them "very secret". All of my accountants have access to this information, as do several of my family members. I wouldn't be surprised if those things eventually leaked in some government breach either.
Learn from Brazil, folks. Brazilian terrorists managed to get access to the mass surveillance system. I literally cannot think of a better argument against mass surveillance.
> both governments and private institutions have pushed for the contrary, more so in recent years.
Yeah...
Brazil in particular will only ever double down on totalitarianism. If people are stepping out of line so brazenly like that, then clearly it's because the boot of the state isn't stepping on their faces hard enough. Lula's government is on the record praising "the chinese model".
Gonna need more surveillance, more data collection, more vague and expansive laws, more judicial activism, more everything.
Lula's opposition would do the same (Bolsonarists and non-Bolsonarists). Brazil is not Sweden. Country for the common man is so shit that nobody cares.
So you're OK with ignoring the rule of law and the constitution, which says the states are responsible for public security, and mass encarcerating people without due process in Salvadoran-style prisons?
And the Banco Master investigation (amongst many, many others), which has been happening under Lula's government and has found all kinds of involvement with PCC, doesn't count as going after drug traffickers/criminal organizations?
The phenomenon of PCC and CV being called terrorists only started when Trump gave those groups the terrorist designation, a patently political act, in order to bolster Flavio Bolsonaro's hypothetical/fake claims of being tough on crime and to try and weaken Lula during the campaign.
The Bolsonaro family's ties with organized crime are deep, widely known, and non-controversial at this point. Flavio never, not once denied it when Lula and others called him a miliciano, and the results of the runoff show who Brazilians believe is better equipped to protect Brazil and its citizens.
> So you're OK with ignoring the rule of law and the constitution
No idea what you're even referring to.
> And the Banco Master investigation ... doesn't count as going after drug traffickers/criminal organizations?
Not really, and they're in the process of burying it anyway. Police started getting too close to the supreme court judge-god-kings, can't have that.
> The phenomenon of PCC and CV being called terrorists only started when Trump gave those groups the terrorist designation
Yes, and it's a designation I agree with. That's why I started calling them terrorists as well. Which is exactly what they are.
> a patently political act, in order to bolster Flavio Bolsonaro's hypothetical/fake claims of being tough on crime and to try and weaken Lula during the campaign.
They're still terrorists either way. That's the literal US designation.
Before Trump decided to designate them terrorists, I used to call them secessionists and enemy combatants. I have no objections to the terrorism accusation. Works for me.
> The Bolsonaro family's ties with organized crime
Sigh. Didn't even mention Bolsonaro in my original reply, and I even criticized his equally totalitarian policies in my second reply.
Stop bringing this guy up. He's powerless and in political asylum in the USA. Remember: Lula is still the Brazilian president.
I'm pretty sure at this point every tax ID (CPF) in Brazil is available on a database you can get on the dark web.
We've had a "CPF-ication" of everything in Brazil over the last few years. The vast majority of people have shared this number with their local grocery store, pharmacy, gym, etc. It's required for a lot of stuff and pretty necessary for others.
Given that, if that's all that leaked here that's a pretty good outcome. It's sad that I think like this but it's kind of how it is.
What makes me more pessimistic is that they claim no financial data was exposed but I wonder if that's really true. And that's where the gold is because then scammers know who to target.
Even if no financial data was exposed, scammers now know these people have/had life insurance with Caixa, which is enough to make them preferred targets and to make scams more convincing.
Both. Brazilian KYC/AML laws are based around the CPF number. It also serves corporations as a stable ID to identify people and track them. It's possible that it's a primary key in their databases.
For example, it's common to get cashback in stores in exchange for the CPF number. They track you, comply with regulations and reward you -- all with one government ID.
Until recently Brazil had no unified national ID document. Each state had theirs. It was possible to have IDs from more than one state. As the tax ID was unique for the whole country, people started using it as unique identifier of choice.
You left out the ending: now we do have an unified national ID document (under gradual adoption, it'll be a few years until it's required), and its number is that tax ID (CPF).
For those who don't know it, our tax id (CPF) is basically public information. For instance: we just had an election. The official public site with the official information about all the candidates (https://divulgacandcontas.tse.jus.br/) has the CPF for all of them. Want to know our president's CPF? It's there.
The bad part is the rest. Having the name together with the phone number, plus being on the list meaning you most likely have one of a particular set of products from Caixa, makes it much easier for the scammers to pretend to be from the bank.
The American SSN was not originally meant to be secret either, nor used for identification other than for Social Security/Tax purposes.
But because it was a nationally unique number for every individual, it got used as a primary key for all sorts of other things, and it ended up becoming very sensitive.
Not disagreeing, but I think it's better to see this from a slightly different perspective:
> But because it was a nationally unique number for every individual, it got used as a primary key for all sorts of other things, and it ended up becoming very sensitive.
What makes it so sensitive is not the fact that it identifies a person and it's used everywhere, it's the fact that it's being used the wrong way. Absolutely no authentication should be done solely on the basis of the SSN. You can still have it be the primary key, but that shouldn't grant authentication by itself.
The Brazilian CPF is the same in identifying a person and being used everywhere, but it's not used a the sole mechanism of authentication as often as the SSN is used, although when it is then it ends up suffering from the same problem.
The only way to really solve this is for governments to enforce that solely knowing these types of IDs can't lead to any authentication, that's unacceptable and should be treated the same way knowing the name of a person is (which funnily enough some governments also treat it wrongly in similar ways, but you get the point).
I find it both a nerve wrecking and interesting thought experiment to assume that all data is going to leak. Could we go through this and get out alive? And, if so, what would the world look like after? It's not at all clear to me it must be worse.
The attacks started hitting Brazil, and it'll be really bad! Multiple people that uses Caixa (in general) aren't tech savvy and could be caught by fraudsters more easily.
No financial information leaked, just tax id, which in Brazil nowadays doesn't mean much. There have been more than one high profile website in the past reportedly selling personal data, including tax identifier (CPF), for essentially any Brazilian citizen.
It is common to be asked for your CPF for trivial things like purchasing anything on a drugstore, and for any and all activity with government branches or banking. This combined with several breaches in government and private institutions in Brazil over the years has made this information essentially public.
More concerning is when more private information is leaked. For example, police security camera live feed and license plate or CPF-based tracking of anyone was sold online in the past, and has been used by criminal gangs in an attempted murder of a judge: https://www.poder360.com.br/justica/pcc-tinha-acesso-a-siste...
This highlights the importance of reducing the amount of data collected, but in Brazil and the rest of the world, both governments and private institutions have pushed for the contrary, more so in recent years.
> It is common to be asked for your CPF for trivial things like purchasing anything on a drugstore
I always point out how insane this is to my Brazilian friends but then I, as a foreigner, have to hand over my passport number instead for the same inane things. I ended up getting a Brazilian eSim and now get spam calls all day.
Why is it insane? You can't do much with the just the CPF number in Brazil, it is not the same as SSN, a CPF is solely for identification.
As I understand it's actually pretty similar to an SSN, i.e it's used for financial and government identification. When it gets used for both trivial and non-trivial things it becomes a huge vector for identity fraud.
My name, birthdate, address and contact info are all widely available online so keeping those government IDs secret is what backstops identity fraud.
In Brazil companies must have the purchaser's (natural person or company) tax ID for invoicing purposes. Point-of-sale in-person sales transactions don't require invoicing, just receipts, but any other commercial transaction does. Even returning merchandise that was bought with a receipt will require an inbound invoice and a CPF. Thanks tax evaders.
Maybe 30 years ago one could think of their CPF as a number to keep mostly private, but since a large part of the economy now goes through digital channels, a CPF is simply a person identifier rather than something secret.
Nobody trusts CPFs to be a secure identifier anymore. The backstop currently rests on biometric validation on B2C scenarios. For more secure purposes (like contracts) we have digital signatures backed by the gov.br infrastructure, which are widespread but requires acceptance by both parties, and also digital signatures backed by PKI like e-CPF and e-CNPJ that carries full validity by law and are equivalent to notarized signatures. Very few people have e-CPFs though.
So you don't understand. Also not every country is a shithole that knowing even a SSN can result in identity fraud.
What’s backwards is an SSN being treated as a secure token. It’s nothing of the sort.
You are never forced to provide your CPF for trivial things, it's completely optional and it's usually used for convenience (easier to get a refund later, for example) and even for people to get some tax discounts in some States. I've never seen anyone showing a passport in Brazil. Though I'm Brazilian, my CPF had been cancelled after more than 10 years I didn't use it (since I haven't lived there in more than 20 years) but that never caused me any inconvenience.
Fun fact: CPF was accepted as identification to vote for President!
Signing up for most things requires a CPF, some offer a passport option but a lot don't. Trying to make a payment online is also sometimes blocked by requiring a CPF. The fact that you can vote with it is just another point for why it shouldn't be treated like an email, those cards look incredibly easy to fake.
You can't vote with just a CPF. The cards aren't issued since 2011, and they didn't have a photo or anything like that. At that time, they were considered tax identifiers only. They moved to printing the CPF number on receipt paper when somebody requested it at the post office when they reached 16-18 years old, usually at the same time when one would request their electoral registration or when requesting an employment booklet. It was a rite of passage to the adult life. More recently all newborns receive a CPF number when they are registered on their birth certificate.
In any case, you have to vote with a photo ID document and you have to scan a fingerprint that was previously enrolled in the electoral justice courts or whenever you renew a driver's license or photo ID. By now 88% of the population have their fingerprints collected for electoral purposes.
In 2023 a law was passed to deprecate state-level ID cards and numbers to use a single federal identifier, and since every economically active person in the country already had a tax ID, the government decided to use the same number.
I do think they cause unnecessary friction for non-residents though, because companies could simply accept passport numbers, as authorized by tax law, but I guess nobody gives this a thought.
As a tourist a few years ago I needed to provide a CPF to buy soccer tickets online in Sao Paulo. Intercity busses also required one to book online. Neither accepted anything else like a passport. It was... inconvenient and not optional for those things!
> never forced to provide your CPF for trivial things
I had to provide my CPF to sign up to a gym.
No, this is very serious. Scammers now have a list of people who have/had life insurance with Caixa.
It doesn’t matter if no other information is leaked, the mere fact that you appeared in this list is financial data about you.
Also, Caixa admits the leak affected all of their insurance customers. So even if you are not on the list, scammers now know one more thing about you. This is bad.
What's the scam this enables for scammers?
Target selection. They now know who has insurance and can target them specifically.
And then?
Spear-phishing, to start with.
lol I just wrote a comment on this thread 3min ago that says basically the same thing and it's funny how we both structured it the same way:
Paragraph 1: All CPFs have already leaked
P2: Even drugstores have your CPF
P3: The problem is if anything else leaks
Brazilian groupthink?
More like Brazilian resignation to our fate.
> just tax id, which in Brazil nowadays doesn't mean much
Fraudsters can go as far as opening bank accounts with that information, take loans an disappear, I don't know what you mean with "doesn't mean much". Not every brazilian is in "BC Protege", which would prevent this.
Also the fact that it has been leaked before does not diminish what has happened here, maybe the new bad actors did not have access to previous information.
But who would be affected, the institutions or the actual customers whose information was leaked? Any fraudulent activity based on the leaked information cannot be directly blamed on the customers themselves and should be a problem the institutions to be stuck with and solve.
You're not looking at the full picture. Of course customers ultimately won't be responsible. But they might have to spend weeks/months/years fighting multiple systems for those accounts/charges/debts to be removed from their names. And just when you think it's solved, there's another one! Anyone who's been through this will tell you that it's very stressful and time consuming, unfortunately.
People are seriously underestimating the impact of these leaks.
I've had government websites authenticate me by CPF and birth date on my first login. These government people made this and thought there was nothing wrong with it, it's literally in production right now.
You are likely misunderstanding what happened. Government websites usually let you use your gov.br app to authenticate and that uses your CPF as username. But it has a hardware stored certificate that identifies you, you don't need a password because it's presenting a cryptographic certificate instead, which is much, much more secure.
The Nota Fiscal website has three access methods: user/password, digital certificate and gov.br account.
I chose the user/password method, and went through their "first access" flow to set up my account. I was asked for my CPF, birth date and some other tax number I don't remember. That was it.
The "much, much more secure" option literally doesn't matter when I can literally bypass it with birth dates and some other tax minutiae that anyone in my accountant's office can get their hands on.
So then are the other HN users here who seemingly dont understand the concept of weakest link in the chain just trolling? fools?
Because what your saying implies the breach is in fact extremely serious for many Brazilians…
Name and shame the government website that does this.
My most recent interaction with a government website that did this: Nota Fiscal.
Didn't have an account, so I had to go through their "first login" flow where it demanded my CPF, birth date and some other tax number thing I don't quite remember. That's all it takes to "verify" my identity, apparently.
It's a system that rolled out nationwide some time ago. I was forced to migrate to it after my city's nota fiscal system was deprecated. Don't remember if the local system was better or worse: my accountant signed up for it, not me.
Honestly, I don't even want them to fix any of this at this point. If they try, I have no doubt they'll double down on the surveillance and mandate facial recognition instead. And when people inevitably start deep faking it with AI, I have no doubt they'll destroy computer freedom because of it by requiring that everybody be restricted to locked down government approved phones.
> some other tax number
I imagine your voter registration. That one is a very "secretive" number, since people used to use it to commit voter fraud by the 80s and 90s.
Anyway, that's a site where you register to report and pay taxes. It's not something other people will rush to do in your name. There is usually extra security on the services that provide stuff that people actually want.
> Anyway, that's a site where you register to report and pay taxes.
No, it's a government website where you generate invoices so that other people can pay you for services rendered. Every businessman needs to deal with this bureaucracy.
> It's not something other people will rush to do in your name.
Anyone who impersonates me and gets into this system could launder money through my business.
You need a digital certificate to generate invoices.
The worst an impersonator who got into this system could do is see all of the invoices of services provided to you or your business.
Which is also bad, but not nearly as bad.
Interesting. I also went through this sign up recently and thought it was weird that it didn’t require gov.br.
But it asked me for my voter ID and the receipt numbers of my last 2 annual tax forms, which are very secret and somewhat in line with the scope of permissions I got (read-only permissions of tax documents). Write permissions required a digital certificate.
I will report this :)
There is a gov.br and digital certificate option, but they are not mandatory.
> the receipt numbers of my last 2 annual tax forms, which are very secret and somewhat in line with the scope of permissions I got
I see.
I wouldn't call them "very secret". All of my accountants have access to this information, as do several of my family members. I wouldn't be surprised if those things eventually leaked in some government breach either.
> https://www.poder360.com.br/justica/pcc-tinha-acesso-a-siste...
Learn from Brazil, folks. Brazilian terrorists managed to get access to the mass surveillance system. I literally cannot think of a better argument against mass surveillance.
> both governments and private institutions have pushed for the contrary, more so in recent years.
Yeah...
Brazil in particular will only ever double down on totalitarianism. If people are stepping out of line so brazenly like that, then clearly it's because the boot of the state isn't stepping on their faces hard enough. Lula's government is on the record praising "the chinese model".
Gonna need more surveillance, more data collection, more vague and expansive laws, more judicial activism, more everything.
Lula's opposition would do the same (Bolsonarists and non-Bolsonarists). Brazil is not Sweden. Country for the common man is so shit that nobody cares.
Correct. Bolsonaro's proposals were so dramatic they were literally called "lights, camera, prison".
But at least he was going to go after the drug trafficking terrorists. Lula just isn't going to do that.
So you're OK with ignoring the rule of law and the constitution, which says the states are responsible for public security, and mass encarcerating people without due process in Salvadoran-style prisons?
And the Banco Master investigation (amongst many, many others), which has been happening under Lula's government and has found all kinds of involvement with PCC, doesn't count as going after drug traffickers/criminal organizations?
The phenomenon of PCC and CV being called terrorists only started when Trump gave those groups the terrorist designation, a patently political act, in order to bolster Flavio Bolsonaro's hypothetical/fake claims of being tough on crime and to try and weaken Lula during the campaign.
The Bolsonaro family's ties with organized crime are deep, widely known, and non-controversial at this point. Flavio never, not once denied it when Lula and others called him a miliciano, and the results of the runoff show who Brazilians believe is better equipped to protect Brazil and its citizens.
> So you're OK with ignoring the rule of law and the constitution
No idea what you're even referring to.
> And the Banco Master investigation ... doesn't count as going after drug traffickers/criminal organizations?
Not really, and they're in the process of burying it anyway. Police started getting too close to the supreme court judge-god-kings, can't have that.
> The phenomenon of PCC and CV being called terrorists only started when Trump gave those groups the terrorist designation
Yes, and it's a designation I agree with. That's why I started calling them terrorists as well. Which is exactly what they are.
> a patently political act, in order to bolster Flavio Bolsonaro's hypothetical/fake claims of being tough on crime and to try and weaken Lula during the campaign.
They're still terrorists either way. That's the literal US designation.
Before Trump decided to designate them terrorists, I used to call them secessionists and enemy combatants. I have no objections to the terrorism accusation. Works for me.
> The Bolsonaro family's ties with organized crime
Sigh. Didn't even mention Bolsonaro in my original reply, and I even criticized his equally totalitarian policies in my second reply.
Stop bringing this guy up. He's powerless and in political asylum in the USA. Remember: Lula is still the Brazilian president.
more violence won't stop drug trafficking
source: 40 years of "war on drugs"
Yeah, and replace them with vigilante militias, that are actually worse.
Putting drug traffickers behind bars or even killing them hasn’t worked. It creates power vacuums that are filled in immediately.
> But at least he was going to go after the drug trafficking terrorists.
Bullshit on that. Also, how isn't he a terrorist? Is arranging 2 bomb attacks not enough?
I'm pretty sure at this point every tax ID (CPF) in Brazil is available on a database you can get on the dark web.
We've had a "CPF-ication" of everything in Brazil over the last few years. The vast majority of people have shared this number with their local grocery store, pharmacy, gym, etc. It's required for a lot of stuff and pretty necessary for others.
Given that, if that's all that leaked here that's a pretty good outcome. It's sad that I think like this but it's kind of how it is.
What makes me more pessimistic is that they claim no financial data was exposed but I wonder if that's really true. And that's where the gold is because then scammers know who to target.
Even if no financial data was exposed, scammers now know these people have/had life insurance with Caixa, which is enough to make them preferred targets and to make scams more convincing.
Many restaurants and events require CPF to open a virtual tab with an RFC card and will refuse service if you refuse to give it
Is this a Brazil law thing or businesses just using it as a readymade ID?
Both. Brazilian KYC/AML laws are based around the CPF number. It also serves corporations as a stable ID to identify people and track them. It's possible that it's a primary key in their databases.
For example, it's common to get cashback in stores in exchange for the CPF number. They track you, comply with regulations and reward you -- all with one government ID.
Until recently Brazil had no unified national ID document. Each state had theirs. It was possible to have IDs from more than one state. As the tax ID was unique for the whole country, people started using it as unique identifier of choice.
You left out the ending: now we do have an unified national ID document (under gradual adoption, it'll be a few years until it's required), and its number is that tax ID (CPF).
For those who don't know it, our tax id (CPF) is basically public information. For instance: we just had an election. The official public site with the official information about all the candidates (https://divulgacandcontas.tse.jus.br/) has the CPF for all of them. Want to know our president's CPF? It's there.
The bad part is the rest. Having the name together with the phone number, plus being on the list meaning you most likely have one of a particular set of products from Caixa, makes it much easier for the scammers to pretend to be from the bank.
Small potatoes. CPFs have been leaked so many times in Brazil that probably all of them are already out there. [0][1][2]
[0] https://cyberbrics.info/the-largest-personal-data-leakage-in...
[1] https://www.bitdefender.com/en-us/blog/hotforsecurity/massiv...
[2] https://www.lumiun.com/blog/en/data-breach-in-brazil-the-wor...
It's important to note the Brazilian tax id (CPF) is not meant to be a well kept secret like the American SSN
The American SSN was not originally meant to be secret either, nor used for identification other than for Social Security/Tax purposes.
But because it was a nationally unique number for every individual, it got used as a primary key for all sorts of other things, and it ended up becoming very sensitive.
Not disagreeing, but I think it's better to see this from a slightly different perspective:
> But because it was a nationally unique number for every individual, it got used as a primary key for all sorts of other things, and it ended up becoming very sensitive.
What makes it so sensitive is not the fact that it identifies a person and it's used everywhere, it's the fact that it's being used the wrong way. Absolutely no authentication should be done solely on the basis of the SSN. You can still have it be the primary key, but that shouldn't grant authentication by itself.
The Brazilian CPF is the same in identifying a person and being used everywhere, but it's not used a the sole mechanism of authentication as often as the SSN is used, although when it is then it ends up suffering from the same problem.
The only way to really solve this is for governments to enforce that solely knowing these types of IDs can't lead to any authentication, that's unacceptable and should be treated the same way knowing the name of a person is (which funnily enough some governments also treat it wrongly in similar ways, but you get the point).
Oof. There's a Catalan bank/insurer called la caixa as well, i thought for a moment it was the same company. But appears not.
I thought the same for a second. Caixa means box both in catalan and portuguese
Yeah I did see the Brazil part but I thought maybe they had expanded internationally just like many banks operate abroad.
Caixa, caja, caisse, and cash all (supposedly) come from the same root (capsa, indeed meaning box in Latin).
I find it both a nerve wrecking and interesting thought experiment to assume that all data is going to leak. Could we go through this and get out alive? And, if so, what would the world look like after? It's not at all clear to me it must be worse.
The attacks started hitting Brazil, and it'll be really bad! Multiple people that uses Caixa (in general) aren't tech savvy and could be caught by fraudsters more easily.
They never really stopped. This is just the latest episode in a long list or breaches. Last one was only a week ago.
https://news.ycombinator.com/item?id=50386104
Thoroughly embarrassing, and it's only ever going to get worse.
Couldn't agree more, my thought is related to get worse, indeed!
Caixa, although is gaining a lot of attention (government spending, bad management and etc), so it could attract more attacks than ever.
My condolences to you Brazilians.
> covers all of its 7.6 million active
How dystopian is it to find reassuring in this situation that a customer doesn't have to wonder whether their data was leaked because it's "all"?
This is a small subset actually as nearly every adult citizen has an account with Caixa.
This is about Caixa the insurer company specifically, not the Caixa bank in general. The leak includes all customers of the former.
are there any technical details on the breach itself?