Caixa Seguridade (CXSE3): CVP Has Data of 7.6 Million Customers Exposed

There was unauthorized access to and copying of personal and registration data from CVP's technology environment. Names and CPFs (Cadastro de Pessoas Físicas, Brazil's individual taxpayer registry numbers) from the registration database, which includes customers and former customers, were exposed. In some records, addresses, phone numbers, email addresses and dates of birth were also exposed.

According to the preliminary investigation, there is no evidence that financial or authentication data was compromised, such as policy values, pension balances, bank details or passwords.

After identifying and blocking the mechanisms used in the attack, CVP implemented additional protection measures. It also launched a technical investigation with an external consulting firm specializing in forensic analysis, to determine the origin, extent and impacts, in addition to monitoring the internet to detect any exposure of the data.

CVP reported the incident on November 11, 2026, to the Brazilian National Data Protection Authority (ANPD), other competent authorities and the affected data subjects. Customers whose mobile phone numbers or email addresses were exposed, as well as vulnerable groups, are being notified, with recommendations against fraud. CVP opened an email channel for questions, and Caixa Seguridade says it will keep the market informed of any relevant developments.