Hacker attack on Brazil's National Treasury exposed data from around 30,000 registrations and 4,000 Pix keys belonging to recipients of federal government payments. The National Treasury Secretariat (STN), part of the Ministry of Finance, confirmed the unauthorized access on Thursday night (12) — eight days after detecting the intrusion on November 4. According to the agency, there was no financial loss and no compromise of the systems that record and release the Union's spending.
What leaked
The intrusion hit two separate databases:
- e-Serviços portal (around 30,000 registrations): names, CPF numbers and email addresses of users of the portal, used to request and follow up on Treasury services.
- Internal analytical query database (around 4,000 Pix keys): Pix keys of recipients of federal government payments, plus data related to payments already made. The official statement mentions payment-related data without saying whether that includes amounts, dates or recipients' names.
Some outlets add the two figures and report 34,000 exposed records. The exposure of a Pix key does not mean the bank or payment account linked to it was compromised.
What was not affected
In a statement, the STN said the incident caused no financial impact and did not compromise the agency's core systems. The state's central financial operations and regular payment flows suffered no interruptions or diversion of funds, according to the Treasury.
Why it was only disclosed eight days later
The unauthorized access was identified on November 4 by the agency's own network monitoring and contained. The public disclosure only came on the night of November 12, and the official statement was published on the Treasury's portal at 9:41 a.m. on Friday (13), citing Article 48 of the LGPD, Brazil's data protection law.
According to the Treasury, disclosure came after the time needed to detect and confirm the incident, conduct internal investigations and implement containment and recovery measures. The case was reported to the National Data Protection Authority (ANPD) and to the government's cyber incident response center (CTIR Gov). Under ANPD Resolution 15, data controllers have three business days to notify the authority and the affected people when an incident may cause relevant harm.
How the intrusion happened, the agency did not reveal. A technical investigation was opened to determine the origin and extent of the episode.
Systems offline until Monday
As a security, analysis and recovery measure, the Treasury took offline query tools and access to documents, historical series and open data available on the agency's website and on the Tesouro Transparente portal. The agency expects to restore the systems by Monday morning (16).
The Treasury stressed that not all systems temporarily offline were affected by the incident: part of the downtime is only a security protocol.
What to do if you were affected
The Treasury warned that the exposed information could be used by third parties to make fraud attempts more convincing, with messages and contacts that appear legitimate. Anyone with questions about the data exposure can contact the Ministry of Finance's data protection officer through Fala.BR, the federal government's ombudsman platform, at falabr.cgu.gov.br.
The context: a week of attacks
The Treasury case is the third major security incident of the week in Brazil, after the Caixa Vida e Previdência data leak and the gov.br and Pix instability on Thursday (12) — covered by Geekiki here: Hacker attack exposes data of 7.6 million Caixa Vida e Previdência clients; gov.br and Pix unstable on the same day.
There is no confirmed link between the episodes. Each has its own origin, scope and investigation, and no agency has stated any connection between them.
Sources
- Tecnoblog — Tesouro Nacional alerta para vazamento de dados pessoais e chaves Pix
- Antihype — Vazamento no Tesouro Nacional: 30 mil CPFs e chaves Pix
- TI Inside — Vazamentos de dados no Tesouro Nacional expõem 4 mil chaves PIX e 34 mil cadastros
- Inova Piauí — Tesouro Nacional identifica vazamento de dados de 30 mil cadastros
- QNews (source: Agência Brasil) — Tesouro prevê normalizar sistemas fora do ar até segunda-feira
Featured image: National Treasury logo (Tesouro Nacional, via Wikimedia Commons, public domain).
This content was produced with the assistance of artificial intelligence and reviewed editorially.
By Muse
