# Brazil's deposit-insurance fund FGC discloses unauthorized access to guarantee-payout personal data · pwn.watch > Brazil's Fundo Garantidor de Créditos (FGC), the country's deposit-insurance and credit guarantor fund, says unauthorized parties accessed personal data in environments related to its internal guarantee-payout payment flows. The suspicion was identified on Oct 26 2026; FGC published a public update on Nov 5 2026. Affected personal data includes name, CPF, email and date of birth, plus guarantee-payment details: withheld tax information and the distribution channel of the guaranteed investment at the liquidated institution. FGC says it has found no evidence so far that the data were disclosed or misused, and no financial loss has been identified. It restricted access, blocked improper accounts, preserved evidence and is reviewing permissions and controls, with specialized firms supporting the ongoing investigation. ANPD (Brazil's data protection authority) and affected data holders have been notified. Page: https://pwn.watch/i/fgc-credit-guarantor-fund-data-breach-nov-2026 · generated 2026-11-06T01:30:35.823Z ## Status - Severity: medium · status: live · patch: partial - Product: FGC (Fundo Garantidor de Créditos) guarantee-payout systems - Started: 2026-10-26 - Affected: Personal data in FGC environments related to internal guarantee-payout payment flows (name, CPF, email, date of birth; withheld tax info and distribution channel of the guaranteed investment) - Fixed in: Nothing for the public to patch; FGC restricted access, blocked improper accounts, preserved evidence and is reviewing permissions and controls ## Follow this incident - RSS (one item per update): https://pwn.watch/i/fgc-credit-guarantor-fund-data-breach-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/fgc-credit-guarantor-fund-data-breach-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/fgc-credit-guarantor-fund-data-breach-nov-2026.json - This file: https://pwn.watch/i/fgc-credit-guarantor-fund-data-breach-nov-2026/llms.txt ## Updates (newest first) - 2026-11-05: FGC publishes a public comunicado: no evidence yet of disclosure or misuse and no financial loss identified; ANPD and affected holders notified; investigation continues with specialized firms. Affected data include name, CPF, email, date of birth and guarantee-payment tax/channel details. (https://www.fgc.org.br/comunicado) - 2026-11-05: Hacker News discusses the FGC disclosure covering PII and payout-related data. (https://news.ycombinator.com/item?id=50386104) - 2026-10-26: FGC identifies suspicion of a security incident involving unauthorized access to personal data in environments related to its guarantee-payout payment flows and begins containment: access restrictions, blocking improper accounts, preserving evidence and reviewing permissions and controls. (https://www.fgc.org.br/comunicado) ## Fix brief # Security brief: Brazil's deposit-insurance fund FGC discloses unauthorized access to guarantee-payout personal data Source: https://pwn.watch/i/fgc-credit-guarantor-fund-data-breach-nov-2026 · status: live · severity: medium · updated Nov 5, 2026, 23:42 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Brazil's Fundo Garantidor de Créditos (FGC), the country's deposit-insurance and credit guarantor fund, says unauthorized parties accessed personal data in environments related to its internal guarantee-payout payment flows. The suspicion was identified on Oct 26 2026; FGC published a public update on Nov 5 2026. Affected personal data includes name, CPF, email and date of birth, plus guarantee-payment details: withheld tax information and the distribution channel of the guaranteed investment at the liquidated institution. FGC says it has found no evidence so far that the data were disclosed or misused, and no financial loss has been identified. It restricted access, blocked improper accounts, preserved evidence and is reviewing permissions and controls, with specialized firms supporting the ongoing investigation. ANPD (Brazil's data protection authority) and affected data holders have been notified. Severity detail: CPF and other PII in guarantee-payout systems accessed; no confirmed misuse or financial loss yet; phishing risk elevated - Product: FGC (Fundo Garantidor de Créditos) guarantee-payout systems ## Affected versions - Personal data in FGC environments related to internal guarantee-payout payment flows (name, CPF, email, date of birth; withheld tax info and distribution channel of the guaranteed investment) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Nothing for the public to patch; FGC restricted access, blocked improper accounts, preserved evidence and is reviewing permissions and controls After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes Readers have nothing to patch. Watch for phishing claiming to be FGC or mentioning guarantee payouts; use the official FGC app and channels only, and do not click links or share codes from unexpected messages. ## Latest updates - Nov 5, 2026: FGC publishes a public comunicado: no evidence yet of disclosure or misuse and no financial loss identified; ANPD and affected holders notified; investigation continues with specialized firms. Affected data include name, CPF, email, date of birth and guarantee-payment tax/channel details. - Nov 5, 2026: Hacker News discusses the FGC disclosure covering PII and payout-related data. - Oct 26, 2026: FGC identifies suspicion of a security incident involving unauthorized access to personal data in environments related to its guarantee-payout payment flows and begins containment: access restrictions, blocking improper accounts, preserving evidence and reviewing permissions and controls. ## Advisories - [Comunicado importante (atualização 05/11/2026)](https://www.fgc.org.br/comunicado) (FGC) ## Write-ups & news - [FGC sofre invasão que expõe nomes, CPFs e outros dados pessoais de clientes](https://g1.globo.com/tecnologia/ciberseguranca/noticia/2026/11/05/fgc-sofre-invasao-que-da-acesso-a-nomes-cpfs.ghtml) - [FGC comunica vazamento de dados pessoais de clientes, incluindo CPF](https://www.cnnbrasil.com.br/economia/money/tecnologia/fgc-comunica-vazamento-de-dados-pessoais-de-clientes-incluindo-cpf/) - [Brazilian Credit Guarantor Fund Data Breach Affecting PII and Payout Data](https://news.ycombinator.com/item?id=50386104) --- Machine-readable: https://pwn.watch/i/fgc-credit-guarantor-fund-data-breach-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.