Brazil 223-million mega-leak

On 20 January 2021, Brazilian researchers revealed what remains the largest personal-data leak in the country's history: databases offering the personal information of roughly 223 million people — more than Brazil's entire living population — for sale on a dark-web forum.

What happened

The leak was first surfaced by PSafe's dfndr lab and the technology portal Tecnoblog, who found a seller on a hacker forum advertising a sprawling collection of Brazilian databases. Because the population figure exceeds Brazil's ~210 million inhabitants, analysts concluded the trove also contained records of deceased individuals, kept on file by data brokers and credit bureaus.

The data was extraordinarily detailed. Beyond names, CPF tax identifiers, dates of birth and gender, the records reportedly included facial images, addresses, phone numbers, email addresses, salary and income figures, credit scores, purchasing-power ratings, marital status, named relatives, voter-registration numbers, education level, LinkedIn profiles and even geographic coordinates. Separate datasets exposed roughly 104 million vehicle records and tens of millions of Brazilian companies.

The seller offered a free, condensed sample and sold the complete material in packages — starting around $500, payable only in Bitcoin — with per-person pricing as low as a few cents.

The Serasa Experian question

The structure and richness of the data — particularly the credit scores and consumer-categorisation fields — led many researchers to suspect it originated from Serasa Experian, Brazil's dominant credit bureau. Serasa publicly denied that its systems were the source, stating that an internal and external forensic review found no evidence of a breach of its environment. The origin of the leak has never been officially confirmed, and no perpetrator has been identified.

Impact and fallout

• An exposure of this scale effectively means near-universal identity-fraud risk for adult Brazilians, enabling synthetic-identity fraud, account takeover and targeted phishing.
• Brazil's Senate, the consumer agency Senacon, and the newly-operational National Data Protection Authority (ANPD) all opened inquiries, making this an early stress-test of the LGPD, Brazil's GDPR-style data-protection law that had entered force in 2020.
• In January 2026, a group claim tied to the episode was filed in the English High Court against Experian entities.

Why it matters

The mega-leak crystallised a structural problem: in a data-broker economy, a single aggregated database can expose an entire nation at once, and attribution becomes nearly impossible when the same fields are held by many companies. It became the defining test case for Brazil's young data-protection regime — and a warning that the most damaging breaches may not be intrusions into one firm, but the quiet commercialisation of everyone's data.