INSS data leak reached 2.8 million CPFs, says Dataprev; 98% were deceased

The leak of data on policyholders from the National Social Security Institute (INSS) reached 2.8 million CPFs, reported this Tuesday (26) Dataprev, a state-owned technology company responsible for managing data on retirees and pensioners.
Of this total, 98% belonged to people who have already died. The same CPF was consulted more than once. Furthermore, around 52 thousand living people had their date of birth exposed during the security incident that occurred in April.
The information was released by Edmar dos Santos Ferreira Junior, representative of Dataprev at this Tuesday's meeting of the National Social Security Council.
The number is higher than what was released when the case became public last week. At the time, INSS technicians reported that data on around 2 million policyholders had been leaked.
Now on g1
Although the causes of the incident are still being investigated, Ferreira Junior stated that a failure has already been identified in a Meu INSS service consultation. According to him, the system, which should require login authentication, was accessible without this security step.
"It was a query that was within a logged-in interface, but it accepted a response for when you had it in a public environment", explained Ferreira, clarifying that the incident lasted one day.
The error, once identified, was corrected, said the Dataprev representative. Currently, according to him, an update to the systems is being developed that will restrict only one user from being able to consult a CPF at a time.
Remember the case
Last week, a security incident at the agency was made public regarding the leakage of data on around 2 million policyholders.
The case was identified almost a month ago, on April 22, by Dataprev, a state-owned technology company that manages data on millions of people, including retirees and pensioners.
In a statement, the INSS said that the necessary measures had been taken and reported that the majority of the data that was exposed was from citizens deceased.
"According to preliminary information, of the total number of CPFs accessed, 97% were of deceased citizens. Dataprev found the occurrence of approximately 50 thousand cases involving individuals who did not have a death record - less than 3% of registered cases. The data is still being consolidated by Dataprev", stated the authority.
Security failure
The institute stated that, despite the data leak, a series of documents and steps are required for it to be approved, for example, the granting of a payroll loan.
The death pension requires a death certificate, among other documents and procedures, added the INSS.
"The granting of any benefit has a series of security locks. The INSS has reinforced its internal controls in order to offer greater security to the analysis of its benefits", says the note.
In 2024, the INSS also confirmed that another vulnerability in the system left confidential information of people with pensions and social and assistance benefits exposed.
Aplicativo Meu INSS
Julia Carneiro/g1

Source: G1