Caixa exposed data of 7.6 million clients

Caixa Vida e Previdência detected an unauthorized access to its systems on November 6, 2026, which allowed personal and registration data to be copied outside the company’s technological environment. The affected database included the company’s 7.6 million active clients and also former clients, although no figure was given for that group.

What information was exposed?

The confirmed exposure included names and CPF numbers. In some records, addresses, phone numbers, email addresses, and dates of birth were also present, according to Extra. Caixa Seguridade also said in its preliminary assessment that there were no signs of compromise affecting financial or authentication data, such as policy values, pension balances, banking details, or passwords.

What did the company do after the incident?

Caixa Seguridade notified Brazil’s National Data Protection Authority and other competent authorities on November 11, 2026. After detecting the unauthorized access, the company said it blocked the mechanisms used in the attack and adopted additional protection measures.

The company also launched a technical investigation with support from an external consulting firm specializing in forensic analysis, to determine the origin, scope, and impact of the incident. In parallel, it began monitoring the internet to identify any possible circulation of the exposed information.

Who did it begin notifying?

Caixa Vida e Previdência began notifying data subjects whose records included mobile phone numbers or email addresses, as well as people belonging to vulnerable groups. According to the company, those notifications include specific recommendations to help prevent possible fraud.