4 ms·

This says that it leaked Brazilians' name & CPF numbers. CPF being the number that people give to every random shopkeeper to enter that tax lottery. So, it's.

by Natsu 6y ago

This says that it leaked Brazilians' name & CPF numbers. CPF being the number that people give to every random shopkeeper to enter that tax lottery. So, it's... not exactly a big secret. To do most official-type things you have to go down to the cartório with your actual ID, not just enter the number. Heck, I've been to places where you had to use one to use the free wifi. Granted, in that particular case, it didn't care if you used someone else's. I wouldn't be surprised if that was also true, elsewhere, honestly. I'm sure someone will find ways to misuse this but Brazil has bigger problems. Also, this doesn't seem to be a leak of government data, it looks like it came from Serasa Experian or one of its contractors. So yeah, I tend to agree with you. If the government does something, it will probably be like that law posted on every elevator warning you to check that there's an actual elevator there, instead of just walking into the empty shaft. For those curious, that'd be lei estadual n^o 9.502 de 11/03/1997 - https://www.al.sp.gov.br/norma/?id=9419 https://www.al.sp.gov.br/norma/?id=9419

Swizec 6y ago
Reminds me of the American SSN. ”This number is super secret and you must guard it with your life and never share! Oh also write it down on every semi-official form, send by paper mail, and enter into all sorts of webapps”
- vmception 6y ago
  I dont bother being secretive about SSN, its security theatre. The person in earshot has a lower likelihood of bothering with it when every service provider that also has it will get mass hacked and are the primary targets. I use a separate TIN or EIN (Tax/Employer Identification Number) where I can. All my businesses have one, even a sole proprietorship that exists purely in your head can obtain one, and this can go on many forms.
  - mixmastamyk 6y ago
    Interesting, if you get paid on another TIN does it effectively become your main SSN? What about at retirement time? Would like to hear more about this.
    - vmception 6y ago
      “Effectively become your main SSN” no but loaded question. less places would have your ssn or tin. the only difference it really makes is peace of mind and relying on the current reality that hackers aren't targeting you or anyone specifically and you will have an additional way to verify yourself if someone did try to do identity theft or whatever you’re worried about. Online People databases will still be reporting pieces of your older SSN while you have been primarily giving services a different number. retirement time isnt a problem. if your business is getting paid and the person that pays needs your tin/ein then thats what they get instead of your ssn. You are still paying self employment taxes contributing to retirement.
    - jccooper 6y ago
      EINs don't accumulate Social Security, but when you file taxes you'll pay "self-employment tax" on earnings from that "business" and those go to your personal SS account. When you use an EIN you're basically claiming to act as a business. For some cases, you can do that just fine. But a lot of SSN requests for identification or credit checks it won't work. And anyone who cares that it's a SSN vs a TIN can figure that out easily.
- Wowfunhappy 6y ago
  SSN's aren't really secret—you can find someone's pretty easily by going to a data broker.
- crazygringo 6y ago
  But the American SSN, while abused, is still supposed to be a secret. I don't believe the Brazilian CPN is meant to be a secret at all. It's used for literally everything. In America, you don't give your SSN to your utility company or when signing up for an online subscription. But in Brazil, you use your CPF to do that.
  - throwawayboise 6y ago
    > In America, you don't give your SSN to your utility company You do where I am, because they run a credit check to determine whether you need to pay a deposit. Legally is not supposed to be used for identity at all, except for Social Security (and IRS) purposes. But in practice that doesn't happen and it's not particularly secret. Used to be pretty common for people to include it on their pre-printed checks. When I was in college it was used as the student ID number. This was all before "identity theft" was really a thing people worried about.
- Natsu 6y ago
  Sure, the SSN is used a lot but it's normally more for things on the level of bank accounts or signing up with a new employer, where there's some serious investment and need to validate your identity. When you enter it into a website, it'd better be for an important reason. The CPF is something you might use at the grocery store when buying a piece of fruit in the hopes of winning 1000 BRL from the government for helping the store prove that it's paying its taxes. Go to SP and every shop will ask "CPF na nota?" True, you can just answer "não obrigado/obrigada" but from what I saw, most people give it out. You just don't see that same level of usage in the USA. You're not going to wander into some store and have the shopkeeper ask for your SSN as soon as you get to the counter.
- Tagbert 6y ago
  But SSN should not really intended to be secret. It is not designed to be a proof of identity, but so many companies have treated it that way that it gives more access than it should. If we could prevent companies from using it like a password, it would no longer be a major risk to have it exposed.
- ledialated 6y ago
  I love being asked to verify my SSN just to access my own information through an unknown entity that will not disclose who they are.
ascorbic 6y ago
The CPF is quite annoying as a tourist. Mostly there are workarounds, but it is ridiculous how many things assume you have one. Yes, fake ones usually work. It was a few years back when I visited, but the hoops I had to jump through to buy an internal flight was unbelievable. I mean, the idea that a non-resident might want to travel within the country on a budget airline right??
- Natsu 6y ago
  Yeah, I hear you. Technically, anyone can get one, though I believe it comes with some annoying tax obligations, so it's not really something one would do as a tourist.
  - aflag 6y ago
    You can even get multiple numbers if you want. Though I think you're not supposed to.
    - cesarb 6y ago
      > multiple numbers At least it's not as wonky as our identity card number. For those who don't know, since our identity cards are emitted by the state governments, instead of the federal government, in theory a single person can have 27 different identity cards, one for each of the 26 states plus the federal district; all of them are valid in the whole country (and beyond, since some Mercosul treaties allow using the identity card instead of the passport).
      - Natsu 6y ago
        That's why there are all those proposals for a Cadastro Único (CU) that would fix this, right? :)
brwolfgang 6y ago
Not just CPF and names were leaked, lots of correlated information was leaked too, such as credit scores, civil status (married, single, etc), gender, birth date, e-mail, phone number, home and work addresses, education level, job, salary, net income, tons of data about bank accounts, even face pictures! All that data, just available for anyone to dig in and do their worst. Source (pt-br) https://tecnoblog.net/404838/exclusivo-vazamento-que-expos-220-milhoes-de-brasileiros-e-pior-do-que-se-pensava/ https://tecnoblog.net/404838/exclusivo-vazamento-que-expos-2...
- rodolphoarruda 6y ago
  Yes, plenty of data for anyone wanting to impersonate you and do social engineering virtually everwhere in the Brazilian territory.
  - cutemonster 6y ago
    Or find people nearby with a bit money and rob them?
- Natsu 6y ago
  Yeah, that's a bit more concerning. I only wanted to make the point that CPF is used very differently from how SSNs are used in the USA.
whzinn 6y ago
Alguem têm o link de download do vazamento?

by Natsu 6y ago

Swizec 6y ago

Reminds me of the American SSN. ”This number is super secret and you must guard it with your life and never share! Oh also write it down on every semi-official form, send by paper mail, and enter into all sorts of webapps”

vmception 6y ago
I dont bother being secretive about SSN, its security theatre. The person in earshot has a lower likelihood of bothering with it when every service provider that also has it will get mass hacked and are the primary targets. I use a separate TIN or EIN (Tax/Employer Identification Number) where I can. All my businesses have one, even a sole proprietorship that exists purely in your head can obtain one, and this can go on many forms.
- mixmastamyk 6y ago
  Interesting, if you get paid on another TIN does it effectively become your main SSN? What about at retirement time? Would like to hear more about this.
  - vmception 6y ago
    “Effectively become your main SSN” no but loaded question. less places would have your ssn or tin. the only difference it really makes is peace of mind and relying on the current reality that hackers aren't targeting you or anyone specifically and you will have an additional way to verify yourself if someone did try to do identity theft or whatever you’re worried about. Online People databases will still be reporting pieces of your older SSN while you have been primarily giving services a different number. retirement time isnt a problem. if your business is getting paid and the person that pays needs your tin/ein then thats what they get instead of your ssn. You are still paying self employment taxes contributing to retirement.
  - jccooper 6y ago
    EINs don't accumulate Social Security, but when you file taxes you'll pay "self-employment tax" on earnings from that "business" and those go to your personal SS account. When you use an EIN you're basically claiming to act as a business. For some cases, you can do that just fine. But a lot of SSN requests for identification or credit checks it won't work. And anyone who cares that it's a SSN vs a TIN can figure that out easily.
Wowfunhappy 6y ago
SSN's aren't really secret—you can find someone's pretty easily by going to a data broker.
crazygringo 6y ago
But the American SSN, while abused, is still supposed to be a secret. I don't believe the Brazilian CPN is meant to be a secret at all. It's used for literally everything. In America, you don't give your SSN to your utility company or when signing up for an online subscription. But in Brazil, you use your CPF to do that.
- throwawayboise 6y ago
  > In America, you don't give your SSN to your utility company You do where I am, because they run a credit check to determine whether you need to pay a deposit. Legally is not supposed to be used for identity at all, except for Social Security (and IRS) purposes. But in practice that doesn't happen and it's not particularly secret. Used to be pretty common for people to include it on their pre-printed checks. When I was in college it was used as the student ID number. This was all before "identity theft" was really a thing people worried about.
Natsu 6y ago
Sure, the SSN is used a lot but it's normally more for things on the level of bank accounts or signing up with a new employer, where there's some serious investment and need to validate your identity. When you enter it into a website, it'd better be for an important reason. The CPF is something you might use at the grocery store when buying a piece of fruit in the hopes of winning 1000 BRL from the government for helping the store prove that it's paying its taxes. Go to SP and every shop will ask "CPF na nota?" True, you can just answer "não obrigado/obrigada" but from what I saw, most people give it out. You just don't see that same level of usage in the USA. You're not going to wander into some store and have the shopkeeper ask for your SSN as soon as you get to the counter.
Tagbert 6y ago
But SSN should not really intended to be secret. It is not designed to be a proof of identity, but so many companies have treated it that way that it gives more access than it should. If we could prevent companies from using it like a password, it would no longer be a major risk to have it exposed.
ledialated 6y ago
I love being asked to verify my SSN just to access my own information through an unknown entity that will not disclose who they are.

ascorbic 6y ago

The CPF is quite annoying as a tourist. Mostly there are workarounds, but it is ridiculous how many things assume you have one. Yes, fake ones usually work. It was a few years back when I visited, but the hoops I had to jump through to buy an internal flight was unbelievable. I mean, the idea that a non-resident might want to travel within the country on a budget airline right??

Natsu 6y ago
Yeah, I hear you. Technically, anyone can get one, though I believe it comes with some annoying tax obligations, so it's not really something one would do as a tourist.
- aflag 6y ago
  You can even get multiple numbers if you want. Though I think you're not supposed to.
  - cesarb 6y ago
    > multiple numbers At least it's not as wonky as our identity card number. For those who don't know, since our identity cards are emitted by the state governments, instead of the federal government, in theory a single person can have 27 different identity cards, one for each of the 26 states plus the federal district; all of them are valid in the whole country (and beyond, since some Mercosul treaties allow using the identity card instead of the passport).
    - Natsu 6y ago
      That's why there are all those proposals for a Cadastro Único (CU) that would fix this, right? :)

brwolfgang 6y ago

Not just CPF and names were leaked, lots of correlated information was leaked too, such as credit scores, civil status (married, single, etc), gender, birth date, e-mail, phone number, home and work addresses, education level, job, salary, net income, tons of data about bank accounts, even face pictures! All that data, just available for anyone to dig in and do their worst. Source (pt-br) https://tecnoblog.net/404838/exclusivo-vazamento-que-expos-220-milhoes-de-brasileiros-e-pior-do-que-se-pensava/ https://tecnoblog.net/404838/exclusivo-vazamento-que-expos-2...

rodolphoarruda 6y ago
Yes, plenty of data for anyone wanting to impersonate you and do social engineering virtually everwhere in the Brazilian territory.
- cutemonster 6y ago
  Or find people nearby with a bit money and rob them?
Natsu 6y ago
Yeah, that's a bit more concerning. I only wanted to make the point that CPF is used very differently from how SSNs are used in the USA.

whzinn 6y ago

Alguem têm o link de download do vazamento?