Brazil's Caixa insurer breach exposes customer tax IDs

Overview

Updated 1 hour ago

On November 6, attackers copied the registration database of Caixa Vida e Previdência, including names and CPF tax numbers for all 7.6 million active customers and some former customers. The insurer told regulators and the market six days later, after blocking the intrusion and hiring a forensic firm.

A CPF is the 11-digit number Brazilians use to open bank accounts, buy insurance, take credit, activate phones and access government services. The company says it has no evidence that policy values, pension balances, bank details or passwords were taken, but names, IDs, addresses, phones and emails are enough for convincing impersonation.

Why it matters

Every active customer's name and CPF were copied, giving fraudsters the core identifiers for impersonation and account applications in Brazil.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

7.6 million

Active customers affected

The breach covers the insurer's entire active customer base, plus an unstated number of former customers.

100%

Share of active customer base exposed

Caixa Vida e Previdência says all 7.6 million active customers were in the copied database.

6 days

Detection to market disclosure

The company found the intrusion on November 6 and Caixa Seguridade disclosed it on November 12.

5 days

Detection to regulator notification

The insurer notified Brazil's data protection authority on November 11.

Digits in a CPF tax ID

The CPF identifies Brazilians for tax, banking, insurance and government services.

Voices

Curated perspectives — historical figures and your fellow readers.

Organizations Involved

Caixa Vida e Previdência

Insurer

Victim of data breach; investigating

Life insurer and pension provider within the Caixa Econômica Federal group.

Caixa Seguridade

Listed parent company

Disclosed breach to market

Listed holding company for Caixa Econômica Federal's insurance and pension businesses.

Brazil's National Data Protection Authority

Data protection authority

Reviewing incident

Brazil's data protection regulator, known as the ANPD.

Caixa Econômica Federal (CAIXA)

State-owned bank

Parent group; says its own systems were not affected

Brazil's state-owned bank and parent group of Caixa Seguridade.

Timeline

4 events Latest: Yesterday

Tap a bar to jump to that date

November 2026
Caixa president calls cyberattacks the new normal
Latest Statement

Caixa's president describes hacker attacks as a global war.
Yesterday
Caixa Seguridade discloses breach to market
Disclosure

Parent company says names and CPFs of all 7.6 million active customers were exposed.
2 days ago
Insurer notifies regulator and customers
Regulatory

Caixa Vida e Previdência tells Brazil's data protection authority and affected customers.
3 days ago
Caixa Vida e Previdência detects unauthorized access
Incident

Attackers copy personal and registration data from the insurer's systems.
November 6th, 2026

Scenarios

ANPD opens formal case against Caixa Vida e Previdência

Possible Resolves by Q2 2027

Discussed by: G1 and Cybersixt, which report that the ANPD is reviewing the incident and has not said whether it will open a case.

The ANPD has said it is analyzing the insurer's transparency and damage-mitigation measures. A formal case would follow if the agency finds the notification late or incomplete. The agency can request more documents and, eventually, issue sanctions under Brazil's General Data Protection Law.

First consumer lawsuit filed over the breach

Possible Resolves by Q1 2027

Discussed by: Techtudo, citing lawyer José Roberto, who says moral damages are not presumed for leaks of common data.

The exposed data are common under Brazil's data protection law, not sensitive data. Brazil's Superior Court of Justice has held that moral damages from leaks of common data are not automatic. A lawsuit would need evidence of fraud, impersonation or another concrete loss.

Stolen customer database is published online

Uncertain Resolves by Feb 28, 2027

Discussed by: Caixa Vida e Previdência, which says it is monitoring the internet and has seen no proof that the data was published or misused.

The company warned that names and CPFs could be used to impersonate the insurer or other institutions. If a database appears on a forum or leak site, phishing attempts may rise. A confirmed publication would raise the pressure on regulators and the company.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

September 2017

Equifax data breach (2017)

Equifax, a U.S. credit bureau, disclosed that attackers had accessed names, Social Security numbers, birth dates and addresses. The breach triggered congressional hearings and the chief executive's exit.

Then

Equifax offered credit monitoring and faced investigations by regulators and lawmakers.

Now

The case became a reference for how identity data, not account balances, drives breach fallout and consumer risk.

Why this matters now

It shows how copied names and tax or Social Security numbers can create years of impersonation risk and regulatory pressure.

February 2015

Anthem data breach (2015)

Health insurer Anthem disclosed that attackers had taken names, birth dates, Social Security numbers and addresses. It notified members and faced state and federal investigations.

Then

Anthem set up notification and identity-protection programs for affected members.

Now

The case became a reference for insurer breach notification and the cost of securing customer identity records.

Why this matters now

A health insurer with similar identity fields had to notify customers and defend its security in court and before regulators.