{"id":"CMP-202611-diwzjb","kind":"campaign","aliases":[],"related":[],"title":"Brazil's deposit guarantee fund FGC breached: names, CPF, emails, birth dates and guarantee payout details of people paid by FGC exposed; expect scams posing as FGC","description":null,"summary":"FGC (Fundo Garantidor de Créditos), the fund that pays out depositors and investors when a Brazilian bank or financial institution is liquidated, reports unauthorized access to personal data in systems used for its guarantee payment process. It spotted the suspected incident on 26 Oct 2026 and published a notice on 5 Nov 2026. Exposed: name, CPF, email and date of birth, plus payout details: taxes withheld on the guarantee payment and the distribution channel through which the guaranteed investment was made at the liquidated institution. FGC says it has no evidence yet that the data was leaked or misused and no financial loss. It blocked rogue accounts, told the ANPD and notified affected people. How the attackers got in, how many people are affected and who is behind it are unknown. FGC warns the data can make fraud calls, messages and emails posing as FGC or other institutions more convincing.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Treat as suspect any call, SMS, WhatsApp message or email that claims to be from FGC (Fundo Garantidor de Créditos) or another institution, mentions your guarantee payment, CPF, birth date or the liquidated bank or broker, and asks for a payment, password, verification code or app install, even if the personal details are correct. FGC's official contacts are fgc.org.br (notice at fgc.org.br/comunicado), the FGC app, atendimento.credores@fgc.org.br, faleconosco@fgc.org.br, privacidade@fgc.org.br and 0800 400 5862. Specific scam sender domains, links or subject lines are not known yet.","fix":"If you got a guarantee payout from FGC, expect targeted scams: do not pay fees, share codes or passwords, or install apps on request. Check anything about your payout only in the FGC app or through the official channels above, keep suspicious messages, file a police report and tell FGC. Watch for identity misuse of your CPF (for example with a credit bureau alert). Businesses in Brazilian finance should warn customers who were paid by FGC.","status":"open","published_at":null,"first_seen_at":"2026-11-05T23:57:40+00:00","triaged_at":"2026-11-05T23:57:40+00:00","updated_at":"2026-11-05T23:58:12+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':29A '2026':79B,87B '26':77B '5':85B 'access':59B 'account':141B 'affect':147B,158B 'anpd':144B 'attack':151B 'bank':51B 'behind':162B 'birth':11A,95B 'block':139B 'brazil':1A 'brazilian':50B 'breach':7A 'call':173B 'campaign':31B 'channel':108B 'cmp':28A 'convinc':184B 'cpf':9A,90B 'crédito':39B 'data':62B,129B,169B 'date':12A,93B 'de':38B 'deposit':3A 'depositor':45B 'detail':16A,98B 'distribut':107B 'diwzjb':30A 'earli':33B 'early-warn':32B 'email':10A,91B,176B 'evid':125B 'expect':23A 'expos':22A,88B 'fgc':6A,21A,27A,35B,120B,166B,179B 'financi':53B,136B 'fraud':172B 'fund':5A,41B 'fundo':36B 'garantidor':37B 'got':152B 'guarante':4A,14A,68B,103B,112B 'incid':75B 'institut':54B,119B,182B 'invest':113B 'investor':47B 'leak':131B 'liquid':56B,118B 'loss':137B 'made':115B 'make':171B 'mani':155B 'messag':174B 'misus':133B 'name':8A,89B 'notic':83B 'notifi':146B 'nov':86B 'oct':78B 'paid':19A 'pay':43B 'payment':69B,104B 'payout':15A,97B 'peopl':18A,148B,156B 'person':61B 'plus':96B 'pose':25A,177B 'process':70B 'publish':81B 'report':57B 'rogu':140B 'say':121B 'scam':24A 'spot':72B 'suspect':74B 'system':64B 'tax':99B 'told':142B 'unauthor':58B 'unknown':165B 'use':65B 'warn':34B,167B 'withheld':100B 'yet':126B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":[],"ptokens":[],"labels":["campaign","earlywarning","medium","other"],"campaign_type":"breach","first_public_at":"2026-11-05T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-diwzjb","url":"https://www.fgc.org.br/comunicado","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-05T23:57:40+00:00","fetched_at":"2026-11-05T23:57:40+00:00","note":null,"cites":["https://www.fgc.org.br/comunicado"]}],"documents":[{"id":81466,"url":"https://news.ycombinator.com/item?id=50386104","title":"Brazilian Credit Guarantor Fund Data Breach Affecting PII and Payout Data","kind":"post","source":"hackernews","publisher":null,"text":"Brazilian Credit Guarantor Fund Data Breach Affecting PII and Payout Data\nhttps://www.fgc.org.br/comunicado\n\n2 points, 0 comments on Hacker News","published_at":"2026-11-05T23:32:36+00:00","relation":"describes","confidence":null,"note":null},{"id":81696,"url":"https://www.fgc.org.br/comunicado","title":"FGC Comunicado: incidente de segurança envolvendo dados pessoais (Fundo Garantidor de Créditos)","kind":"advisory","source":"analyst","publisher":null,"text":"FGC (Brazil's Fundo Garantidor de Créditos) notice updated 05/11/2026: unauthorized access to personal data in environments for internal processes of the guarantee payment flow. Suspected incident identified 26 Oct 2026. Data: name, CPF, email, date of birth; guarantee payment data: taxes withheld on payment and the distribution channel through which the guaranteed investment was made at the liquidated institution. No evidence yet of disclosure or misuse, no financial loss identified; investigation ongoing with specialist firms; ANPD notified; affected people notified. Rogue accounts blocked. Warns data may be used for convincing fraud contacts impersonating FGC or other institutions asking for payments, passwords, codes or app installs. Use the FGC app and official channels; contact atendimento.credores@fgc.org.br, faleconosco@fgc.org.br, 0800 400 5862.","published_at":"2026-11-05T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}