Caixa Vida e Previdência: intrusion copies registration database covering 7.6M active clients (names, CPF)
Severity: high · Patch status: unknown · Since 2026-11-12
Caixa Seguridade Participações, the listed holding company, told the market in a notice dated 12 November 2026 that its subsidiary Caixa Vida e Previdência (CVP) suffered a cybersecurity incident. CVP identified unauthorized access on 6 November 2026 in which personal and customer registration data was copied outside its technology environment. The attack mechanisms were identified and blocked, and an external forensic firm is working to establish origin, scope and impact. The company confirms exposure of names and CPF tax IDs from the registration database, which includes current and former customers and covers all 7.6 million active customers; some records also held addresses, phone numbers, email addresses and dates of birth. It reports no sign that financial or authentication data was compromised (policy amounts, pension balances, banking details or passwords), and no public disclosure or misuse of the data identified so far. CVP reported the incident to Brazil's data protection authority ANPD and other authorities on 11 November and is notifying affected people, starting with those whose phone numbers or emails were exposed and vulnerable groups. The attacker, the intrusion vector and the number of records copied are not disclosed.
What to do
- Monitor for phishing and fraud attempts targeting customers; notify affected customers per LGPD requirements
- Investigate source of exposure and contain further leakage
- Check whether exposed data appears on leak forums and dark-web markets
- Review third-party and CDN-hosted document access controls
- Prepare regulatory notifications to ANPD and relevant authorities
Sources
All live incidents on Threat Watch
