BRAZIL · CYBERSECURITY
Brazil’s National Treasury Secretariat, part of the Finance Ministry, said on Thursday 12 November 2026 that unauthorised access exposed personal data from about 30,000 registrations. It says the data included names, tax numbers and email addresses.
It also says about 4,000 Pix keys were exposed, along with payment information. Pix is Brazil’s instant-payment system, and a Pix key is the short identifier, such as a tax number, phone number or email, that people use to receive money on it.
Key Facts
- What The Treasury says data on about 30,000 registrations and about 4,000 Pix keys were exposed.
- When The Treasury says it identified the access on Wednesday 4 November 2026 and announced it on Thursday 12 November.
- Who The Treasury says the Pix keys belong to recipients of federal government payments.
- Impact The Treasury says there was no financial impact and no core system was affected.
What Happened
Everything below is the Treasury’s own account of the incident, and as of Friday 13 November 2026 we found no independent confirmation of its scope. It says the unauthorised access was identified on Wednesday 4 November 2026.
The accessed data included names, CPF numbers (Brazil’s 11-digit personal taxpayer number) and email addresses registered in e-Serviços, the portal people use to request and follow Treasury services. The Treasury says the incident also reached a database used for internal queries, which held about 4,000 Pix keys of people who receive federal payments.
The Treasury says information about payments made to those people was exposed as well. It says there was no financial impact and that none of its core systems, which it calls structuring systems, was affected.
It says it reinforced monitoring and applied extra protection measures, and that its technical investigation continues. It told the ANPD, Brazil’s national data protection authority, and CTIR Gov, the federal government’s cyber-incident response centre.
Why It Matters
The Treasury warned that criminals could use the exposed data to make fraud attempts more convincing. It advised people to be careful with suspicious messages or contacts that ask for personal data, passwords or payments.
The mechanism is simple: a real name, a tax number and a payment history can let a scammer sound like an official. That is our reading of the Treasury’s warning, not a finding that the data has been misused.
What Happens Next
The Treasury has announced no date for the end of its investigation. People with questions are told to contact the Finance Ministry’s data protection officer through Fala.BR, the federal government’s official information and ombudsman platform.
We will report any new findings the Treasury or the data protection authority publishes. Readers who receive unexpected messages about federal payments should not click links or share passwords.
What It Means for You
This is a data-security story rather than a market story, and we have no sign of a market effect. It matters most to Brazilians who receive federal payments and to anyone watching the safety of Pix, Brazil’s main instant-payment system; see our report on Pix.
Foreign readers who deal with Brazilian government portals should treat unexpected contact with the same caution. More coverage is on our Brazil news page and in The Rio Times Latin America Power Index, our ranking of political influence across the region.
What Is Not Known
The Treasury has not publicly said how the access happened or who was behind it. We will update this report if it does.
It is not known whether the exposed data has been misused. The Treasury says there was no financial impact.
Frequently Asked Questions
What did Brazil’s Treasury say was exposed?
The Treasury says the exposed data includes names, CPF numbers and email addresses from about 30,000 registrations in its e-Serviços portal. It also says about 4,000 Pix keys of federal payment recipients, plus payment information, were exposed.
When was the breach found?
The Treasury says it identified the unauthorised access on Wednesday 4 November 2026. It announced the incident on Thursday 12 November 2026.
Did anyone lose money?
The Treasury says there was no financial impact and that no core system was affected. It says its investigation continues.
What should affected people do?
The Treasury advises care with suspicious messages or contacts that ask for personal data, passwords or payments. Questions go to the Finance Ministry’s data protection officer through Fala.BR.
Sources: National Treasury Secretariat statement of 12 November 2026.
This article was produced by The Rio Times’ automated AI newsroom. Editorial responsibility: Matthias Camenzind, Publisher and Editor-in-Chief. The Rio Times also runs Ask Rio Times, which answers from 100,000+ of our own articles, the daily Latin America Power Map, and prediction-market odds on elections and markets.. How we use AI · Report an error
Brazil runoff, Sunday, October 25: Brazil runoff: date, poll closing times and when results start. Latest: Brazil runoff polls, Flávio 51%, Lula 49%.