All Brazilians potentially impacted by alleged breach of Experian subsidiary

Cybernews reports that Serasa Experian, the Brazilian subsidiary of credit risk and fraud prevention firm Experian, had 1.8 TB of data belonging to 223 million individuals, which is larger than the Brazilian population, claimed to have been stolen by a threat actor.

Included in the file leaked by the attacker were 5,000 records containing CPF numbers akin to Social Security numbers, full names, dates of birth, emails, gender, phone numbers, and job titles. If legitimate, researchers believe the dataset could include information from both living and deceased individuals.

"With a target's CPF, occupation, and phone number, a criminal can convincingly impersonate bank officials or government agents to drain accounts," said Cybernews researchers.

In 2021, Brazilians were affected by a similarly massive data leak that exposed salary data, facial images, CPFs, addresses, credit scores, email addresses, and phone numbers. The incident is the subject of a lawsuit filed in the English High Court earlier this year. Indonesia and China are two other countries that have experienced large-scale data exposures in recent years.