Leak at Caixa exposes registration data of 7.6 million pension area clients

The workflow of millions of offices worldwide suddenly stopped on Thursday due to a failure in the email service servers for Outlook and the Microsoft 365 service from technology giant Microsoft. This technical glitch caused difficulties for thousands of users when sending, receiving emails, and logging into their accounts.

According to the DownDetector platform, which tracks the status of online services, the issue with Outlook began around 1 PM Eastern Time. Soon, the number of complaints sharply increased, peaking when over 100,000 messages related to Outlook were registered.

Similarly, more than 15,000 users reported problems with Microsoft 365. Microsoft confirmed this outage on the social network X and stated that its team was investigating the situation.

Initially, it seemed the problem was limited to the US, but later the company admitted that its impact could be global. Microsoft stated: 'While we work to mitigate the impact, we confirm that this issue may affect connectivity to Microsoft 365 services for users in any region.'

The company specified that an excessive load increased on part of its infrastructure in several regions, leading to connection issues. To balance the load, Microsoft began redistributing network traffic across its global infrastructure.

During this outage, the Microsoft status page (status.cloud.microsoft), which was supposed to provide information, also encountered a loading error. Nevertheless, the company notified users about the possibility of receiving updates through the Admin Center using codes EX1550543 and MO1550821. At the time of publication, engineers continued to work on a full resolution of the issue.

A cyberattack hit Caixa Vida e Previdência, resulting in the exposure of personal data of current and former institution clients, including names and CPF numbers. Although the incident was detected on Friday, the 6th, it was only made public this Thursday, the 12th.

The company, which is a subsidiary of Caixa Seguridade, confirmed that there was unauthorized access to its systems and that copies of registration and personal information were taken outside its technological environment. The affected database contains records of 7.6 million active clients, although the official communication does not specify how many individuals actually had their information exposed.

In addition to names and CPFs, the compromised data may include addresses, phone numbers, emails, and dates of birth for a portion of the records. Caixa Seguridade assures that, so far, there are no signs that financial or authentication information has been breached, which includes policy values, pension balances, bank details, and passwords.

After identifying the undue access, the company took immediate measures, blocking the mechanisms used in the attack and implementing new layers of protection. A technical investigation was initiated with the help of specialized forensic auditing consultancy to determine the exact circumstances of the occurrence.

The National Data Protection Agency (ANPD) is currently monitoring the actions adopted by the institution, with a special focus on transparency and mitigating any potential harm to data subjects. The agency stated that it can request additional clarification from Caixa if it deems necessary.

Clients whose phones or emails were exposed, as well as groups classified as vulnerable, are being notified and receiving guidance to prevent fraud. Caixa has also provided an email channel to answer the questions of those affected.

On the same day the security incident was disclosed, users began reporting problems with Caixa's Pix service. According to Downdetector, which monitors complaints about digital services, failure reports emerged around 10 am this Thursday (12) and increased during the morning, exceeding a thousand notifications by 1 pm.

Reports included difficulties accessing the application, making transfers, and sending or receiving payments. Downdetector indicated that 55% of complaints referred to problems with the mobile application, 28% were related to transfers, and 14% to internet banking, which is access via browser.

As of now, there is no information establishing a direct link between the Pix instability and the cyberattack suffered by Caixa Vida e Previdência. The original article on this topic was initially published in Olhar Digital.

The Credit Guarantee Fund (FGC) notified about the detection of unauthorized access to its clients' personal data. The compromised information includes names, CPF numbers, email addresses, and dates of birth.

The entity responsible for the FGC formally communicated this incident to the National Data Protection Agency (ANPD). Although the exact number of affected individuals has not been disclosed, the FGC assured that all clients whose data was accessed received a notification.

The suspected intrusion was detected on October 26th. Immediately after identifying the problem, the FGC took security measures, restricting access to the involved systems, deactivating irregular accounts, and intensifying monitoring, in addition to preserving all necessary evidence for the investigation.

With the help of specialized companies, the FGC is currently investigating the true extent of the access, verifying whether these pieces of information were copied, disseminated, or misused.

Even without concrete evidence that the data was disclosed or improperly used, the FGC warns that the obtained information could facilitate more credible fraud attempts. For this reason, the institution advises impacted clients to exercise extreme caution with phone calls, messages, and emails from individuals claiming to represent the FGC.

In an official statement, the fund declared that no financial loss was found as a result of the occurrence. The investigation continues, supported by specialized companies, aiming to clarify the extent of the access and confirm the absence of copying, disclosure, or improper use of the data.

It is important to note that the FGC operates as a private non-profit association, functioning as a kind of guarantee to protect the amount of depositors and investors if a bank faces difficulties, citing Banco Master as an example.