Caixa Vida e Previdência confirms breach exposing data of 7.6 million customers

Caixa Vida e Previdência said attackers took names and taxpayer ID numbers known as CPF for every one of its 7.6 million active customers from the customer registration database after detecting unauthorized access on November 6, 2026.

The company said some exposed records included home addresses and birthdates, along with phone numbers and e-mail addresses. An initial review by the insurer found no indication that anyone had accessed financial or authentication data, specifically policy values, pension balances, bank information and passwords. The company said it has not yet seen proof that anyone posted the data publicly or used it improperly.

The CPF taxpayer ID in Brazil has 11 digits and lets people open bank accounts or insurance policies, apply for credit, buy phones and use government services. CVP said outside parties might use the stolen details to pretend to be the insurer or other organizations. The company warned that someone armed with a name and CPF can sound convincing over the phone, and that knowing a name, taxpayer ID or address does not prove a caller is legitimate. Holders of Caixa life or pension policies in Brazil or other countries may see more phishing attempts, which are deceptive messages seeking information.

The insurer said it found unauthorized access on November 6, 2026, and determined that personal and registration data had left its technology systems. On November 11, 2026, CVP notified Brazil’s National Data Protection Authority and other regulators under the General Data Protection Law. The parent company, Caixa Seguridade, then submitted a market disclosure to Brazil’s securities regulator, the CVM, on Thursday, November 12, 2026, revealing a cyber incident.

CVP has not said how the attackers got in, how long they stayed, or whether any former customers were affected in addition to the 7.6 million active customers. It remains unclear whether Brazil’s data protection authority will open a case or issue a fine. Future securities filings and actions by the data protection authority will show how serious the fallout becomes.

The insurer halted the attack methods, added protections, hired an outside forensics firm and is monitoring the internet for any publication of the data. CVP is contacting people whose mobile numbers or e-mail addresses were exposed, along with vulnerable groups, and is sending them guidance on avoiding fraud. A dedicated e-mail address, comunicado.DPO@caixavidaeprevidencia.com.br, is available for customer questions about the incident.

The company told customers to treat unexpected calls, messages or e-mails asking for payments, transfers, passwords, authentication codes or Pix transfers with suspicion, and never to share codes, passwords or one-time tokens with anyone who contacts them. Customers should be cautious about urgent messages concerning insurance, pensions, benefits, payouts or claims, and should contact the company directly if a message pressures them to act. The company also said customers should not click links or open attachments in suspicious messages and should rely only on official company channels. Before repeating a Pix transaction, customers should verify their statement and transfer status to prevent duplicate payments.

The insurer’s parent, Caixa Seguridade, is tied to state-owned bank Caixa Econômica Federal and trades on Brazil’s B3 exchange under the ticker CXSE3. The company was formed in 2021 through a venture shared by Caixa Seguridade Participações S.A. and France’s CNP Assurances. The insurer said there is no sign the breach directly affected Caixa Econômica Federal checking accounts, savings accounts, payment cards or lottery services. Customers reported Pix payment and banking app problems on November 12, 2026, with no indication the outage ties to the CVP incident.

The data protection authority is examining the company’s response, with a focus on transparency and limiting harm, and could ask for information. The holding company promised to update the market as new information emerges.

“So far we have not identified evidence of public disclosure or misuse,” CVP said in a notice to affected customers, here translated from Portuguese. CVP said in a website notice to data subjects that customer service and operations were unaffected at any time.