National Treasury Suffers Attack and Exposes Data of 30,000 People and 4,000 Pix Keys

The National Treasury Department confirmed unauthorized access to personal data of approximately 30,000 users and information from about 4,000 Pix keys related to payments made by the Federal Government. The incident was identified on November 4, but was only officially disclosed on Thursday night.

According to the agency, the improper access reached two databases used in administrative and payment activities. Among the information exposed are full names, CPF numbers, email addresses and Pix keys of federal transfer recipients.

Despite the severity of the episode, the National Treasury reported that there was no financial impact identified or compromise of the main systems of the institution.

What data has been exposed by the National Treasury?

According to the information released, the incident involved two distinct bases:

30,000 registrations: names, CPFs and e-mail addresses of citizens registered on the e-Services portal, used to request and monitor National Treasury services.

4 thousand Pix keys: data from Federal Government payment recipients, including Pix identifiers and transaction-related information.

The institution warns that improperly accessed data can be used by criminals to apply scams, especially through false messages, fraudulent emails and contacts that simulate official communications.

Data leakage can facilitate scams involving the Pix

The main risk for citizens is the possibility of using personal information in attempts to fraud.

With names, CPFs and other data, criminals can create seemingly legitimate messages, claiming problems in payments, need for cadastral update or alleged pending matters related to the Federal Government.

The guidance is to be suspicious of unexpected contacts who request passwords, security codes, financial transfers or confirmation of personal information.

It is important to note that the knowledge of a Pix key, in isolation, does not allow to move money from the bank account of the holder. However, when combined with other data, this information can facilitate social engineering attempts.

National Treasury says financial systems have been preserved

In a statement, the National Treasury Department said its security mechanisms have identified and interrupted unauthorized access.

After detection, additional protection measures, reinforcement of technological monitoring and containment procedures were adopted.

The agency also initiated a technical investigation to clarify how the incident occurred and determine its extent.

According to the institution, the structuring systems remained preserved and no financial losses arising from the episode were identified.

The incident was reported to the authorities

The National Treasury reported that it notified the National Data Protection Agency (ANPD) and the Center for Prevention, Treatment and Response to Government Cyber Incidents (CTIR Gov).

The institution justified that the interval between the identification of the problem, on November 4, and the public disclosure, on November 12, was necessary to confirm the incident, conduct internal analyses and implement security measures.

What to do in case of suspected data exposure?

The recommendation is to redouble the care with messages received by WhatsApp, SMS, e-mail or telephone calls that mention public payments or cadastral information.

Citizens wishing clarification can use the official channel of Ombudsman and Access to Information of the Federal Government, the Fala.BR.

The service allows you to forward requests to the person in charge of the processing of personal data of the Ministry of Finance. (The information is from Agência Brasil)

Read also Alckmin in Agriculture can improve relationship with agro