BC reports personal data leak of 160,000 Pix keys

The Central Bank reported this Friday (21) the occurrence of a security incident with leakage of personal data linked to Pix keys that were under the custody and responsibility of Acesso Soluções de Pagamento.

According to the BC, among the potentially exposed data are user name, CPF, relationship institution and branch number and account of 160,147 Pix keys. The occurrence was observed between December 3 and 5, 2021.

According to the note, no sensitive data, such as passwords, information on transactions or financial balances in accounts or other information under bank secrecy, were exposed.

“The information obtained is of a cadastral nature, which does not allow the movement of resources, nor access to accounts or other financial information”, he said.

According to the Central Bank, people who had their registration data exposed from the incident will be notified exclusively through the institution’s application or internet banking. Contact is not made by other means, such as phone, text message or email.

The monetary authority also said that it has adopted the necessary actions for the detailed investigation of the case and will apply the sanctions provided for in the rules in force.

“Even though it is not required by current legislation, due to the low potential impact for users, the BC decided to communicate the event to society, in view of the commitment to transparency that governs its performance”, he said.

Sought by Reuters, Acesso reported that it identified improper queries to data related to Pix keys and that sensitive data was not exposed.

“We took, in a timely manner, all the necessary measures to guarantee the security of the information held by the company and our commitment to keep the market and our partners informed”, he said.

This is not the first case of its kind. In September last year, the BC reported leaking data from Pix keys under the responsibility of Banese (Banco do Estado de Sergipe).