Front pageRansomware & Data Breaches
Brazil Treasury’s STN Breach Exposes Personal Data and Pix Keys
Around 30,000 users’ personal details and 4,000 Pix keys were leaked after an unauthorized access to Brazil’s Treasury e‑Serviços platform.
- Filed
- Read
- 2 min read
Brazil’s Treasury National (STN) confirmed that an unauthorized intrusion into its technology environment was detected on 4 November 2026. The breach affected the e‑Serviços portal, which stores personal information for citizens using government digital services.
Background and discovery
The STN’s internal security and monitoring tools identified the anomalous activity within hours of it occurring. After containment, the agency informed the National Data Protection Authority (ANPD) and the Government Cyber Incident Response Center (CTIR Gov). A public statement was released on 12 November 2026, eight days after the initial detection.
How the breach unfolded
Investigators determined that the attackers accessed data linked to roughly 30,000 e‑Serviços users. The exposed records included full names, CPF numbers (Brazilian tax IDs) and email addresses. In addition, about 4,000 beneficiaries of government payment programs had their Pix keys – the instant‑payment identifiers used in Brazil’s banking system – accessed.
STN officials emphasized that core banking and financial systems remained untouched and that no direct financial loss was reported. The agency’s response team quickly isolated the compromised segment and began hardening the surrounding infrastructure.
Who is affected
The incident primarily impacts Brazilian citizens whose personal data and Pix keys were stored in the Treasury’s e‑Serviços portal. While the exact number of individual victims is not known beyond the approximate figures, the breach potentially exposes users to identity‑theft attempts and fraudulent payment requests.
Why it matters
Pix has become a cornerstone of Brazil’s payment ecosystem, handling billions of transactions daily. Exposure of Pix keys could enable social engineering attacks that trick users into authorising unauthorized transfers. Moreover, the leak of CPF numbers and emails provides a rich dataset for phishing campaigns targeting both individuals and public‑sector employees.
Although STN reports no immediate misuse of the data, the lack of details about the attackers and the cause of the intrusion leaves open the risk of future exploitation. The breach underscores the importance of robust segmentation and continuous monitoring for government platforms that hold sensitive personal and financial identifiers.
What follows
STN has launched a technical investigation and is reinforcing system protections. The agency’s notification to ANPD triggers a regulatory review under Brazil’s data‑protection law, which may result in further compliance requirements or penalties if negligence is found.
Sources
Sources
Keep reading
Compromised Institutional Email Accounts Fuel Bomb Threats Across European Schools.
A wave of bomb-threat hoaxes targeting European schools has been linked to compromised institutional email accounts. The incidents highlight how attackers can exploit trusted communication channels to cause widespread disruption.
Critical RCE Flaw in PTC Windchill and FlexPLM Actively Exploited, Patches Now Available
A CVE‑2026‑12569 remote‑code execution bug in PTC’s Windchill and FlexPLM products scores 9.3, is being weaponized, and patches have been released for on‑premise and hosted deployments.
Active Exploitation of Outlook CVE‑2026‑124194 Prompts Immediate Patch Rollout
Microsoft Outlook’s CVE‑2026‑124194 is being weaponised to steal NTLMv2 hashes; IT teams must apply the November 11 patch or follow CISA mitigations.