On December 5th, new thefts of personal data were discovered in the market. Data protection information was allegedly taken from public agency pages and negotiated with the Meta group, which owns Facebook, for amounts of around R$1,400.00 for the personal data of millions of Brazilians.
According to a report by Folha de São Paulo, the criminals would remove information from the Unified Health System, the SUS, the National Traffic Secretariat, as well as from Federal Revenue channels, in addition to the National Institute of Social Security, the INSS, in the financial part of Boa Vista and in the National Weapons System of the Federal Police.
Allegedly, the sellers would separate the information that is sold into “groups” that can only be provided by filling in special logins and passwords. After the purchase, the buyer would receive both personal data and sensitive personal data, such as: full name; address; CPF; ID; names of descendants and ancestors; income; driver’s license signature; voter registration card; social benefits provided by the government, as well as any criminal and/or civil information in the name of the people involved.
Even so, it is worth noting that the National Data Protection Authority, the ANPD, has so far reported the absence of an inspection process, making it necessary to verify whether the leaks are not the result of other acts.
Furthermore, Rede Globo de Comunicação indicated the location of the website where the transactions are made. The service operates through a subscription fee of R$1,400.00 per week for access. Apparently, these sales do not occur on the “sub-net”, known as the Deep Web, but rather in places that are easily accessible to any group, such as Facebook itself, the largest social network on the planet, through its conventional chat.
This case is yet another example of how data mapping is an essential tool within a LGPD implementation program, as a way of providing visibility of the information circuit within a company and its respective marketing chain, so that, based on this insight, the real risks that data processing operations may entail can be addressed.
By: Leonardo Neri, Fernanda Lobato and Fabiana Porta