🇧🇷🔓💥💸 — DATA BREACH: Confidential information of 39 million Brazilian beneficiaries of the National Institute of Social Security (INSS) was exposed to external users due to a security flaw in the Unified Benefits Information System (Suibe)

➡️ The flaw exposed information including registration data and types of benefits, such as pensions and sick leave, making beneficiaries easy targets for financial institutions to offer services. The situation was exacerbated by the lack of control over the use of passwords, which may have been retained by former employees or improperly shared.

❌ According to investigations, the INSS did not present concrete evidence of data leakage, but the history of complaints from policyholders suggests that the data was accessed and misused by third parties.

🔑 As a result, the system, provided by Dataprev, underwent a security review and was restored with new access rules, including VPN and digital certificates issued by Serpro.

🇧🇷 Now, only 11 accesses are allowed, distributed among the Federal Police, the Comptroller General of the Union (CGU), the Federal Court of Accounts (TCU), and the Ministries of Social Development and Agriculture. Granting new accesses requires a formal procedure, maintaining control over who can access the system.

Source 🖇