Caixa Vida e Previdência, the life insurance and pension company controlled by Caixa Seguridade, has confirmed that attackers copied personal data from its customer registration database, exposing the names and CPF tax ID numbers of all 7.6 million of its active customers.
The Brazilian insurer said the database also holds records on former customers, and that some records included home addresses, phone numbers, email addresses and dates of birth.
Data copied out of CVP’s environment
According to a notice to the market published by Caixa Seguridade on November 12, 2026, Caixa Vida e Previdência (CVP) identified on November 6 that it had been the victim of unauthorized access and that personal and registration data had been copied outside its technology environment.
CVP said it identified and blocked the mechanisms used in the attack, added further protections and brought in an external forensics firm to determine the origin, scope and impact of the incident. It is also monitoring the internet for any publication of the data.
The company has not said how the attackers got in, how long they had access or how many former customers are affected on top of the 7.6 million active ones.
What was exposed and what was not
Based on the analysis so far, CVP confirmed the exposure of:
- Full names
- CPF numbers (Brazil’s individual taxpayer ID)
- Home addresses, in part of the records
- Phone numbers and email addresses, in part of the records
- Dates of birth, in part of the records
The company said its preliminary investigation found no sign that financial or authentication data was compromised, including policy amounts, pension plan balances, bank details or passwords. In a notice to data subjects on its website, CVP added that customer service and operations were not affected at any point.
Regulators and customers notified
CVP reported the incident on November 11 to Brazil’s National Data Protection Authority (ANPD) and other authorities under the country’s General Data Protection Law (LGPD). The ANPD told local media it is reviewing the measures CVP has taken, especially on transparency and reducing harm to the people affected, and may ask the company for more information.
The insurer said it is directly contacting affected people whose mobile numbers or email addresses were exposed, along with vulnerable groups, with advice on how to avoid fraud. It has set up a dedicated inbox for questions at comunicado.DPO@caixavidaeprevidencia.com.br.
No ransomware or extortion group had publicly claimed the attack at time of publication, and CVP has not said whether it received a ransom demand.
Why CPF numbers matter
The CPF is used across Brazil to open bank accounts, apply for credit, buy phones and access government services. A name and CPF together, especially with a birth date and address, give fraudsters what they need to impersonate a customer convincingly or attempt account takeovers at other companies.
CVP warned customers that someone knowing their name, CPF or address does not prove a contact is legitimate. Its advice includes:
- Be suspicious of unexpected calls, messages or emails asking for payments, transfers, passwords, authentication codes or Pix transfers
- Be careful with contacts about insurance, pensions, benefits, withdrawals or claims that demand urgent action
- Do not click links or open attachments in suspicious messages, and reach CVP only through its official channels
- Keep messages and records if you suspect fraud and report it to the authorities and your bank
Our guides on spotting a fake breach notification and checking a suspicious email safely cover the same warning signs.
Part of Brazil’s largest state bank group
Caixa Seguridade is the insurance arm of Caixa Econômica Federal, Brazil’s state-owned bank, and is listed on the B3 stock exchange. Separately on November 12, users reported problems with Caixa’s Pix payments and banking app. There is no indication that the outage is related to the CVP incident.
Financial and insurance companies continue to face large customer data thefts, including recent confirmed breaches at Mirae Asset Life and Mirae Asset Securities.
BreachNews will update this story if CVP discloses how the attackers got in, the number of former customers affected or any claim of responsibility.
