Brazil's world-beating data breach
Brazil’s public health agency has suffered what is arguably the worst data-exposure in world history, losing 243m+ records in a country of 211m people (the excess represents dead peoples’ records).
https://www.cpomagazine.com/cyber-security/brazils-health-ministrys-website-data-leak-exposed-243-million-medical-records-for-more-than-6-months/
For more than six months, the HTML for the website for the Sistema Único de Saúde included the login and password to access the database as an administrator; the credentials were obscured through Base 64 encoding, a trivially detected measure that is just as easy to bypass.
It was the second grave security error at SUS in less than a month (last month, a SUS techie posted a spreadsheet with the system’s database keys, logins and passwords to Github, exposing 16m records).
Another leak exposed records in the country’s covid tracing data.
The exposed records include the most highly sensitive information: names, dates of birth, full health records, addresses and phone numbers.
Included in the breach are many officials, including the Brazilian dictator Jair Bolsonaro and his junta.
The insecure systems were built by an IT contractor called Zello (formerly MBI Mobi), which has billed the Brazilian state $8.5m since 2017.
The vulnerabilities were discovered by the NGO Open Knowledge Brasil, who sounded the alarm. The breach puts every Brazilian at risk of identity theft and many other forms of cyberattack.
gummygunk
tangentwithtanner
annaxmalina
theartofmadeline
titsay
