Caixa Seguridade Unit Hit by Data Breach

Caixa Seguridade, the insurance arm of Brazil’s state bank Caixa, says an outsider gained unauthorised access to its client records. The registration base involved includes all 7.6 million of its active clients.

What Happened

Caixa Seguridade (CXSE3 on the B3 stock exchange in São Paulo) is the insurance and pensions holding company of state bank Caixa Econômica Federal. On Thursday 12 November 2026 it filed a notice to the market with the CVM, Brazil’s securities regulator, disclosing a cyber incident; its company profile is on our Caixa Seguridade page.

The notice says its subsidiary Caixa Vida e Previdência, known as CVP, identified unauthorised access on Friday 6 November. Personal and registration data had been copied out of its technology environment.

CVP notified the ANPD, Brazil’s national data protection authority, and other competent authorities on Wednesday 11 November. It did so under the LGPD, Brazil’s General Data Protection Law.

Caixa Seguridade said it will keep the market informed of relevant developments. For wider context, see our coverage of the Brazil economy and markets.

What Was Exposed

The copied records include names and CPF numbers, the 11-digit taxpayer ID used to open bank accounts and insurance policies. For part of the records, addresses, phone numbers, e-mails and dates of birth were also taken.

The data come from CVP’s registration base of clients and former clients. That base includes all 7.6 million of the unit’s active clients.

CVP’s preliminary analysis found no sign that financial or authentication data were compromised. That covers policy values, pension balances, bank details and passwords.

CVP says it is monitoring the internet for exposure of the data and has strengthened system protection. It has also hired outside consultants to assess the impact.

“So far we have not identified evidence of public disclosure or misuse,” CVP said in a notice to affected customers, here translated from Portuguese. It also opened a dedicated e-mail channel for client questions.

What It Means for You

Anyone holding a Caixa life or pension policy, in Brazil or abroad, could face more phishing, meaning deceptive messages that try to extract further information. CVP warns that third parties could use the data to impersonate Caixa Vida e Previdência or other institutions.

Never share codes, passwords or one-time tokens with anyone who contacts you. Check any message against the company’s notice and use only its official channels.

A caller who knows your name and CPF can sound convincing. If a message creates urgency, stop and contact the company yourself.

What Is Not Known

The notice does not say who accessed the data or how. It also does not say whether the data are circulating.

It is unclear whether the ANPD will open a proceeding or impose a fine. Further filings with the CVM and any step by the ANPD will show how large the consequences become.

Frequently Asked Questions

What did Caixa Vida e Previdência report?

Caixa Seguridade disclosed that its unit CVP identified unauthorised access and copying of personal and registration data from its systems on 6 November 2026. The parent company filed the disclosure with the CVM on 12 November.

Which data were exposed?

Names and CPF taxpayer numbers, and for part of the records addresses, phone numbers, e-mails and dates of birth. Preliminary analysis found no sign that policy values, pension balances, bank details or passwords were affected.

How many clients are affected?

The data come from CVP’s registration base of clients and former clients. That base includes all 7.6 million of its active clients.

How can clients protect themselves?

Expect deceptive contacts and never share codes or passwords. Verify messages through the company’s official channels and use the dedicated e-mail channel CVP opened for questions.