Massive Brazil insurer breach leaks tax IDs of all 7.6 million customers

Brazilian insurer Caixa Vida e Previdência (CVP) has suffered a major data breach, exposing the personal information of its entire customer base. The company discovered unauthorized access on November 6, 2026, with attackers copying data from its systems. A subsequent investigation confirmed that names and CPF numbers (Brazilian taxpayer IDs) of all 7.6 million active customers were stolen, making this one of the largest breaches in Brazil's financial sector.

The exposed data includes not just tax IDs but also addresses, phone numbers, email addresses, and dates of birth for some records. While the company claims financial data and passwords weren't compromised, the stolen information creates significant fraud risks for millions of Brazilians. CVP is now notifying affected customers and has established a dedicated email for inquiries, but the breach highlights persistent security vulnerabilities in large financial institutions handling sensitive citizen data.

What to do: Monitor communications from CVP and follow their recommended protective measures against fraud.