13 ms·
Giant leak exposes data from almost all Brazilians
- geek_at 6y agoHas anyone calculated at the current rate of leaks how long would it take for every human on earth to be in some of these lists?
- nicoburns 6y agoIt doesn't really work like that. Some humans are likely completely off grid and not on record anywhere.
- reaperducer 6y agoSome humans are likely completely off grid and not on record anywhere. Quite a few, including a good percentage of my relatives. One is particularly good at it. Aside from the wages his employer reports to the federal government, property ownership records, and an SSN, he simply doesn't exist. His get paid each week in cash. Doesn't have a bank account or credit card. Because of his lifestyle and the type of vehicle he uses, he doesn't need a driver's license, registration, or insurance. His home has solar panels, a propane generator, and a well, so no utilities. I don't know what he does about trash service, but having seen the town, I wouldn't be surprised if it's still legal to burn your garbage on your property. He's happy. Not paranoid that I can tell. He just lives a simple life where satisfaction comes from reading books and improving his mind, and not from hoarding electronic gadgets and social media thumbs to prove his worth.
- xiphias2 6y agoI treat my face, name, birthday and numbers as open data. Maybe companies should stop using these things for verification and start allowing people to use cryptography more efficiently.
- randerson 6y agoI can just imagine the future: Instead of reading stories of Identity Theft, we'll read about people getting locked out of their identity .. like the folks today who lose their Bitcoin keys.
- rudyfink 6y ago"Of course, you can always pay a recovery company to get your identity back. But, that's expensive--more than most people have. The company will do it on credit (if they like your prospects), but then they have title to your identity until you pay them back, which, for many, is a day that never comes. The charges, service fees, garnishments, and interest on the above just add up and up."
- r00fus 6y agoWhere is this from?
- airstrike 6y agoIt makes for an effective gloomy sci-fi atmosphere, but does it really make sense? What's stopping someone from starting a better recovery company that actually gets the job done and doesn't do it on credit but for a fee? Incentives are not aligned if I have to pay interest because then the company has no reason to actually recover the identity
- nkrisc 6y agoThat won't happen until companies are held liable for damages caused by inadequate authentication processes. If a bank gives a credit card to someone who says they're me, based on only on my SSN, I don't see why that should be my problem. It's between the bank and whomever they gave the card to. If they don't know who they actually gave it, well then it sounds like they need to improve their process. But it becomes my problem because it's my credit score that gets ruined.
- Yizahi 6y agoAny day now. I guess we will have a global info system a-la Hyperion with zero privacy. It will be suspicious to be absent from such a system instead.
- Lammy 6y agoI would guess "some time around 2012".
- deleted 6y ago[deleted]
- atbpaca 6y agoAnother embarrassment for Bolsonaro and his minions. #impeachment
- andersonvieira 6y agoI don't see how your comment is anything more than FUD. The leaked information suggests it may have come from Serasa Experian [1], although they deny it, or some third-party that provides services to them. I haven't seen any evidence the government has anything to do with this. [1] https://tecnoblog.net/405077/especialistas-alertam-para-riscos-apos-vazamento-que-expos-220-milhoes-de-brasileiros/ https://tecnoblog.net/405077/especialistas-alertam-para-risc...
- rapfaria 6y agoHow is this directly related to Bolsonaro? Because it happened in the country he is president of?
- gcblkjaidfj 6y agoThe original comment is likely a troll, but the current goverment did place a bunch of amateur hacks on the highest positions of power, which led to things like the minister of culture asserting to the public that woman belongs in the kitchen, or that the minister of education asserting in public that the humanities like sociology and history must disappear from the face of earth, and the ministry of environment saying in a leaked video of a presidential meeting that thanks to covid they now had the distraction they needed to kill indians and give the land to soy farmers. So, even if trollish comment, it is not too removed from truth. I can see how incompetence, cost cuts, corruption and favoritism (he did place all his sons in a trump-like fashion in his cabinet) might have led to this. Not to mention relaxing of oversight and the rule of law which allowed for even more departments (and the private companies working for those) to hold and share this information without concerns. The previous government (removed illegitimacy in a coup) did place emphasis on digital security. Brazil have safe electronic voting for decades and Brazilians receive a java application by the gov to do their taxes since the 90s. The current gov was elected on the basis of "we will undo everything the last <<corrupt>> government did"
- hi5eyes 6y agohttps://www.somagnews.com/giant-leak-exposes-data-from-almost-all-brazilians/ https://www.somagnews.com/giant-leak-exposes-data-from-almos... links to the source of the snippet > According to the experts, who use artificial intelligence techniques to identify malicious links and fake news, the leaked data contains detailed information on 104 million vehicles and about 40 million companies, potentially vulnerable to 220 million people.
- marcosdumay 6y agoThanks, finally somebody telling what data is on the leak. > Information on the more than 104 million vehicles reveals important details, such as chassis number, license plate, municipality, color, make, model, year of manufacture, engine capacity and even the type of fuel used. In the case of legal entities, the following were leaked: CNPJ, corporate name, trade name and date of foundation. Every piece of information on this list is either plainly visible (for cars) or published by the government. The article talks about data of real people (not companies), but doesn't say what leaked about them.
- Fabricio20 6y agoThis link [0] may have the information you are looking for. The link above seems to be from an unrelated breach, the one discussed in the OP affects pretty much everything, not even your LinkedIn profile managed to escape. [0]: https://tecnoblog.net/404838/exclusivo-vazamento-que-expos-220-milhoes-de-brasileiros-e-pior-do-que-se-pensava/ https://tecnoblog.net/404838/exclusivo-vazamento-que-expos-2...
- marcosdumay 6y agoWow, yes, that has the information. That's a really broad leak.
- diegoholiveira 6y ago> The article talks about data of real people (not companies), but doesn't say what leaked about them. Personal data (CPF, Birth day and so on), credit scores, social class, acquisitive power, and other informations that a company specialised in credit score have. (the leak is probably from a credit score company).
- aww_dang 6y agoArticles about breaches rarely if ever contain a link to the actual data. I'm left trusting the journalist, who may or may not be tech literate. Even a random sampling of the records would be more illustrative than anything these bloggers post about.
- dyingkneepad 6y ago> “No, we have bigger problems than that to worry about.” Pretty much that. In the "Maslow's pyramid of government-related needs", the doxxing is near the top. People are much more worried with stuff like not dying to covid, not being kidnapped, not dying in traffic, paying the dreaded Boletos (bills), etc. Internet doxxing is dwarfed by the more urgent needs. Brazilians are also sure that exactly zero things are going to be done about these leaks. Some government representative is going to say "we're going to investigate" and that's as much as we're going to get. I would love to be wrong here, by the way.
- Natsu 6y agoThis says that it leaked Brazilians' name & CPF numbers. CPF being the number that people give to every random shopkeeper to enter that tax lottery. So, it's... not exactly a big secret. To do most official-type things you have to go down to the cartório with your actual ID, not just enter the number. Heck, I've been to places where you had to use one to use the free wifi. Granted, in that particular case, it didn't care if you used someone else's. I wouldn't be surprised if that was also true, elsewhere, honestly. I'm sure someone will find ways to misuse this but Brazil has bigger problems. Also, this doesn't seem to be a leak of government data, it looks like it came from Serasa Experian or one of its contractors. So yeah, I tend to agree with you. If the government does something, it will probably be like that law posted on every elevator warning you to check that there's an actual elevator there, instead of just walking into the empty shaft. For those curious, that'd be lei estadual n^o 9.502 de 11/03/1997 - https://www.al.sp.gov.br/norma/?id=9419 https://www.al.sp.gov.br/norma/?id=9419
- Swizec 6y agoReminds me of the American SSN. ”This number is super secret and you must guard it with your life and never share! Oh also write it down on every semi-official form, send by paper mail, and enter into all sorts of webapps”
- vmception 6y agoI dont bother being secretive about SSN, its security theatre. The person in earshot has a lower likelihood of bothering with it when every service provider that also has it will get mass hacked and are the primary targets. I use a separate TIN or EIN (Tax/Employer Identification Number) where I can. All my businesses have one, even a sole proprietorship that exists purely in your head can obtain one, and this can go on many forms.
- afrcnc 6y agoAnother one? Didn't this also happen last month? (https://www.zdnet.com/article/data-of-243-million-brazilians-exposed-online-via-website-source-code/ https://www.zdnet.com/article/data-of-243-million-brazilians...)
- rafaelturk 6y agoBrazilian here. Same leak. New info suggest that the files contained far more info than previously thought.
- hezag 6y agoYep, another one. This time it's from a Credit bureau.
- EGreg 6y agoAnother month another set of news that can be solved by NOT storing all the data in one place by one company. But for that we need better software. This article is literally like The Onion article about guns. Maybe we should put it with names changed every few months: https://qbix.com/blog https://qbix.com/blog
- diego_moita 6y ago> vulnerable to 220 million people. In a country with 207 million people. This means that even the dead can't rest in peace. On the bright side, we'll not have any data leaks anymore because there will be no more secrets to leak. :)
- Chico75 6y agoProbably concerns citizens living abroad as well
- cuca_de_chumbo 6y agoI was born dual US/Brazil and left Brazil just after turning 18 about 36 years ago, wondering wondering whether I'm in the leak and whether anyone could use my info to open illicit bank accounts, etc. I don't want to be associated with money-laundering, and am too far in headspace from financial-institutions/credit-bureaus to check it out.
- FalconSensei 6y agoIf you declared permanent out-of-country move, you (or an impersonator) shouldn't be able to open accounts/buy things - as far as I know.
- kinow 6y agoI think there are extra fees as a foreigner. You are not prohibited of having a bank account, insurance, using credit, etc. But most systems will prevent the CPF of being used without some sort of special approval.
- anothernewdude 6y agoOnly 207 million? I thought there was at least a brazillian.
- Bancakes 6y ago
- Xunjin 6y agoI'm so proud of my country, we just got the goal, time to double it. And If you ask the politicians to improve security, they will probably say "put 2 more security guard outside the building".
- jbotz 6y agoThe Brazilian blog "Tecnoblog" has the full details here[1], with a list of all the information allegedly included in this data. If they are correct that's pretty much everything about everybody... I mean personal info (like addresses and phones, family, education, employer), financial info (like bank accounts, salary, credit score, creditors, bounced checks, whether receiving government assistance), other background info... for some entries (over a million) there even mugshots! [1] https://tecnoblog.net/404838/exclusivo-vazamento-que-expos-220-milhoes-de-brasileiros-e-pior-do-que-se-pensava/ https://tecnoblog.net/404838/exclusivo-vazamento-que-expos-2...
- malandrew 6y agoIs there a way for someone to look up what leaked about them so they can determine how problematic this could be?
- slig 6y agoYes. The hacker has a contact email where you can send queries using the CPF (unique for each Brazilian) of whoever you want. He'll then send you a bitcoin address for payment and send you back the info.
- ObscureScience 6y agoIt would be pretty short-sighted to reward such an individual.
- exporectomy 6y agoWould it? Hacking on the internet is pretty much immune to conventional systems that keep people honest, like being able to be caught and prosecuted or social norms. I think it's more useful to see hackers as like a force of nature to defend against but which it's useless to try to do any moralizing about. The more hacking that happens, the more secure computers will (hopefully) be made in defense, and the less vulnerable to future hacks. Hopefully it's not an endless arms race and eventually we figure out standard ways to keep things secure as a result.
- pelasaco 6y agoI don't see how it can be new. When I lived some years in Brazil (around 1999-2001), and you could buy at a specific street in Sao Paulo, a CD with all the taxes information from every brazilian citizen.
- FalconSensei 6y agoI remember seeing the news, years ago, that a guy was trying to discover were spammers were getting his email. So he created a bunch of emails for different things. Guess which email started receiving spam very quickly? Yeah, the one he used for taxes
- Consultant32452 6y agoI remember in the 90s when we thought it was funny to sign people up for every newsletter we could find. You could basically destroy someone's email address making it forever unusable by spending an hour signing up for junk.
- code-is-code 6y agoI was even able to dos my mail server with a bot that signed up newsletters.
- guiambros 6y agoI've been doing this for exact 20 years this week. I always use a unique address for each site (pretty easy; I just use a wildcard domain). Pretty much everything has been leaked: most retailers, software companies, all phpBB forums, wordpress blogs, Experian, Amazon (3P Sellers, not AMZN itself), Dropbox, LinkedIn. The list goes on and on. Notable exceptions: Google, Microsoft, Apple, IRS. These days is a lot harder to see leaks, as most egregious spams get filtered even before it hits your server (I use GSuite).
- pabs3 6y agoA better option than a wildcard domain with spam filtering is a server where there is zero spam filtering and each unique address goes to a unique folder. Then you have much more opportunity to detect leaks to spammers.
- danilocesar 6y agoEven tough it's sound pretty bad and big (and it is), this is not new to brazilians. It's a known thing that you can buy DVDs (yes, DVDs) with personal data from millions of Brazilians customers on the streets of Sao Paulo. Daylight market (called Camelo's). There was some news articles about it a few years ago. Even the former president data was there. Social Security Number (not as secret as it is in the US and Canada), address, name, phone number. Even some family relations. It was pretty cheap.
- barbolo 6y agoThis leak is much more harmful. If the data really comes from Serasa Experian, they have more accurate and structured data from people/companies/assets in Brazil than anyone else.
- doubleclutch 6y agoSo, CPF is not really a big deal, but I think here you can map cars based on license plates to persons and companies. Think about it.
- doubleclutch 6y agoCPF is not a big deal, but if I read it correctly, you can basically search people/companies based on license plates, which is a big deal.
- barbolo 6y agoIt's much worse than that. The leak contains dozens of datasets (relatives, addresses, jobs (+ linkedin), schools, vehicles, income, debts, pictures of faces, companies).
- geoffbp 6y agoSheesh!
- iandanforth 6y agoMan, why can't we get some useful data leaks? Like all the records from companies incorporated in DE, or all the tax records from companies and rich people or another one from offshore account havens.
- rightbyte 6y agoEver heard of the Panama Papers?
- vkou 6y agoThe problem with useful data leaks is that the people working on them have an unfortunate habit of getting killed. https://en.wikipedia.org/wiki/Daphne_Caruana_Galizia https://en.wikipedia.org/wiki/Daphne_Caruana_Galizia > At the time of her death, Daphne Caruana Galizia was facing 48 libel suits. > On 16 October 2017, Caruana Galizia was driving close to her home in Bidnija, when a car bomb placed in her leased Peugeot 108 exploded, killing her instantly. The blast occurred on Bidnija Road, and left the vehicle scattered in several pieces across nearby fields.
- thatguy0900 6y agoI would assume the companies working on those accounts care more about security than the company working for average citizens. They can actually go out of business and see consequences after being hacked as opposed to, say, experian.
- EGreg 6y agoWe should literally start making a parody of this article, but on our blog: https://en.wikipedia.org/wiki/%27No_Way_To_Prevent_This,%27_Says_Only_Nation_Where_This_Regularly_Happens https://en.wikipedia.org/wiki/%27No_Way_To_Prevent_This,%27_... EDIT: I wrote it https://qbix.com/blog/2021/01/25/no-way-to-prevent-this-says-only-industry-where-this-regularly-happens/ https://qbix.com/blog/2021/01/25/no-way-to-prevent-this-says...
- dang 6y agoUrl changed from https://www.databreaches.net/giant-leak-exposes-data-from-almost-all-brazilians/ https://www.databreaches.net/giant-leak-exposes-data-from-al..., which points to this.
- forkLding 6y agoI wonder if at a certain point the value of data falls simply because so much is leaked illegally online
- shadowprofile77 6y agoI would argue that if anything, in our current world of privacy and anonymity-indifferent lawyers, regulators, policy makers, corporate heads and most members of the general public, things like this and the hackers behind them perform a sort of obscene public service in a way: They make everyone at least somewhat leery about trends towards so much of our private lives falling into too many databases, especially when said data is highly personal, financial, medical or location-based (and thus especially compromising in certain contexts) The reason why? While lawmakers, politicians and corporate heads couldn't give less of a shit about the average joe's privacy, they know that it's increasingly difficult even for them and their own families to stay private from too-pervasive, intrusive data collection, and they also now see ever more often just how near impossible it is to make said data stay secure from mass public leaks. Oops... Their own "optimization" obsessed nosiness maybe biting them back bit by bit. It would be perversely amusing to see the head of some bullshit ad tracking firm, or bottom-feeding user data reseller, or the head of a snooping social network have their own dirty laundry leaked all over the web for all to see.
- alek_m 6y agoWelcome to the future
- kazinator 6y agoSuggested editorialization: "Nation wide Brazilian exposes privates"