Loading story…
More than 102,000 records tied to Brazil’s Health Surveillance Information System (SISVISA) were exposed online through a publicly accessible database that lacked authentication or other security protections. Security researcher Jeremiah Fowler discovered the instance and reported that anyone with the URL could browse roughly 102,215 files totaling about 79 GB, exposing sensitive personal and government-related information including names, addresses, phone numbers, CPF and CNPJ tax identifiers, identity documents, inspection records, complaint files, and backup archives.
The leaked data also reportedly included scans of driver’s licenses, doctor identification cards, photos, and fingerprints, raising risks of phishing, identity theft, and financial fraud for affected individuals. Public access to the database was revoked after Fowler alerted multiple government offices, but officials had not publicly clarified how long the system was exposed, whether the database was managed by government personnel or a third party, or whether unauthorized users accessed or copied the information.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
SISVISA replaced paper-based workflows to digitize approvals and compliance tracking for Brazilian health authorities.
Public access to the database was revoked or disabled shortly after Fowler's disclosure and warnings. The sources say it remains unclear how long the database had been exposed or whether anyone accessed the data.
After discovering the exposure, Fowler alerted ExpressVPN and sent urgent warnings to several government offices about the exposed SISVISA database.
Security researcher Jeremiah Fowler found a publicly accessible SISVISA-linked database with no authentication or basic security protections, exposing 102,215 files totaling about 79 GB. The data included personal, tax, biometric, and regulatory records.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported a large, publicly exposed database on an open cloud server containing **tens of millions of French citizen records** aggregated from at least five prior breaches, including voter data, healthcare entries, CRM contacts, financial profiles (including **IBANs/BICs**), and vehicle-related information. The dataset appears to have been compiled to increase resale value and enable identity cross-linking, elevating risks of **phishing, fraud, and identity theft**. Separately, Australia’s **Victorian Department of Education** notified parents that an unauthorized party accessed a student database containing names, school names, year levels, school-issued email addresses, and **encrypted passwords**, prompting a forced password reset and temporary account access disruption; the department stated more sensitive fields (e.g., home addresses, phone numbers) were not exposed and investigators had not confirmed public release. In another unrelated report, researchers questioned the veracity of a newly claimed **PayPal** breach, assessing a ~100,000-record credential “combolist” as likely **outdated infostealer-log data** rather than evidence of a fresh PayPal compromise, noting PayPal’s prior refutation of similar claims and the practical barriers posed by MFA.
Jun 29, 2026
Researchers and media reports disclosed enormous troves of exposed login data, including an unprotected 47.42 GB database containing **184,162,718** unique usernames and passwords tied to services such as Microsoft, Facebook, Google, Instagram, Snapchat, Discord, Netflix, PayPal, and government portals in 29 countries. Security researcher Jeremiah Fowler found the database on an unmanaged server with no password protection or encryption, and sample records included account types, website URLs, and plaintext passwords labeled `senha`. Fowler said multiple individuals confirmed the leaked credentials were genuine after he contacted them directly. The exposed records are believed to be linked to **infostealer malware** and broader malware-as-a-service collection operations, with subsequent reporting describing a far larger cache totaling **16 billion** credentials affecting major consumer platforms including Apple, Facebook, and Google. The disclosures raise immediate risks of credential stuffing, account takeover, phishing, fraud, and unauthorized access to corporate and government systems. Public access to the 184 million-record database was later restricted after responsible disclosure to the hosting provider, but the owner of the data remains unidentified.
Jun 29, 2026
Identity-verification provider **IDScan** confirmed that attackers stole data from its cloud systems during a reportedly year-long intrusion. The compromised dataset includes full names, driver’s-license numbers, and identification numbers from other government documents, including passports; IDScan holds more than 150 million driver’s-license records. The records were advertised on a dark-web marketplace and reportedly searchable for more than 150 million people in the United States and Canada, potentially including photographs. The seller and breach method have not been publicly identified, while IDScan continues its investigation and the FBI is investigating; the Pentagon said it was aware of reports that Defense Secretary Pete Hegseth’s information appeared in the database.
Sep 15, 2026