Caixa Seguridade reports theft of personal data of 7.6 million customers of its pensions subsidiary

Caixa Seguridade said on Thursday, November 12, in a notice to the market, that its subsidiary Caixa Vida e Previdência (CVP) identified on November 6 unauthorised access to its systems followed by the copying of personal and registration data outside its technology environment, according to Agência Brasil and CNN Brasil. Both outlets put at 7.6 million the company's active customers whose database was affected, which also includes former customers.

According to CNN Brasil, preliminary analyses point to the exposure of names and CPF numbers, the Brazilian tax registry, and in some of the records also addresses, phone numbers, email addresses and dates of birth. Agência Brasil quotes the notice as saying that, based on the preliminary investigation, there is no indication that financial or authentication data, such as policy values, pension plan balances, bank details or passwords, were compromised.

The company says it blocked the mechanisms used in the attack, strengthened protection and opened a technical investigation with an external forensic consultancy, as well as monitoring the internet to detect whether the data is published. According to Agência Brasil, CVP notified the National Data Protection Authority (ANPD) and other authorities on November 11, and is alerting those affected with recommendations given the risk of fraud.

Developing story: the notice was published on Thursday afternoon, shortly before the window of this edition, and Caixa Seguridade's filing with the CVM, Brazil's securities regulator, could not be opened directly. It is not yet known who is behind the attack, how the access occurred or whether the data has been published.