Massive Data Leak Hits Top Companies Across Brazil

Data Breach Summary

A significant data leak has surfaced on the dark web, allegedly affecting some of Brazil’s largest and most recognized companies. The post, made by the user sos4 on darkforums.st, contains a massive trove of sensitive corporate data, now accessible through a public GoFile link.

This leak includes:

• Access credentials for databases (MongoDB, MySQL, Redis)
• API keys (Google, Microsoft, Mautic, and unknown services)
• SMTP email server access
• Cloud configurations (ElasticSearch, AWS SQS, Firebase)
• Internal platforms (CRMs, ERPs)
• Sensitive integrations like Telegram, Airtable, and Notion

The companies named include Willbank, Daycoval, Banco PAN, Asaas, Nubank, Itaú, Bradesco, C6 Bank, Ambev, Boticário, Crefaz, Safra, Renner, Bees Bank, among others.

---

Where and How?

The dump reportedly contains sensitive technical infrastructure data and internal credentials, giving potential attackers access to critical systems used in banking, retail, and communications. The extent of the exposure spans databases, APIs, email services, cloud tools, and more—making this breach a serious threat to both organizations and end-users.

Company Data Breach History

While Brazil has seen numerous breaches in the past, such as the 2021 national ID data leak and incidents involving Bradesco and Nubank, this type of multi-company, cross-platform exposure appears unprecedented.

At the time of this post, no official statements or confirmations have been issued by any of the affected entities, and no mainstream media outlets have covered this specific incident. However, the type and volume of data suggest this breach is significant and potentially authentic.

---

Recommendations for Personal Data Protection

How Users Can Protect Their Information:

• Change any reused passwords connected to services potentially affected.
• Enable two-factor authentication (2FA) on all accounts.
• Watch for phishing emails that might impersonate your bank or service provider.
• If you’re a developer or employee of these companies, verify and rotate any exposed credentials.

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.