137 thousand Pix keys from Ipiranga network customers were leaked, says BC

The Central Bank reported this Friday (16th) the leak of data linked to 137,285 Pix keys of customers of Abastece Aí, an application of the Ipiranga service station network, between July 1st and September 14th.

According to the autarchy, no sensitive data, such as passwords, information on transactions or financial balances in accounts or other information under bank secrecy, were exposed.

“The information obtained is of a cadastral nature, which does not allow the movement of resources, nor access to accounts or other financial information”, the monetary authority communicated in a note.

Sought, the Ipiranga network had not manifested itself until 3:40 pm this Friday.

The BC said that it has taken the “necessary actions” to investigate the case and that it will apply the sanctioning measures provided for in the regulation.

The monetary authority also stated that people who had their registration data leaked will be notified exclusively through the application or through the internet banking of the relationship institution.

“Neither the BC nor the participating institutions will use any other means of communication to affected users, such as messaging apps, phone calls, SMS or email”, he detailed.

This was the fourth case of a Pix key leak since the launch of the real-time resource transfer system in November 2020.

In February this year, the BC reported an incident involving 2,112 Pix keys from customers of the payment institution Logbank, which took place between January 24th and 25th.

After this case, BC President Roberto Campos Neto said at an event that data leaks would occur with “some frequency”, but that the monetary authority would act to ensure that the occurrences were as few as possible.

“As we understand that this world of data will grow exponentially, leaks will happen with some frequency. Not wanting to trivialize leaks, because we will attack all leaks so that they are as few as possible”, he said.

Another similar case was reported by the BC on January 21 this year. About 160,100 customers of Acesso Soluções de Pagamento had Pix key data leaked between December 3 and 5, 2021. The first such leak occurred on August 24, 2021, reaching 414,526 Pix keys linked to Banese (Banco do State of Sergipe).

Currently, Pix has 131.8 million registered users, including individuals and companies. As a holder can have more than one key, the number of keys exceeds 478 million, according to BC data.