Serasa Experian

A dataset containing records linked to more than 220 million Brazilian residents surfaced for sale on a dark web forum in January 2021, in what researchers described as the largest data leak in Brazil's history. According to our investigation team, the listing tied to Serasa Experian contains 223,739,216 rows, including 223,739,215 records with a social security number, which in the Brazilian context corresponds to the CPF individual taxpayer registry, and 223,739,216 records with a name. Brazilian cybersecurity firm PSafe reported uncovering the archive on January 20, 2021, and noted that the number of exposed individuals exceeded the country's population, suggesting records of both living and deceased people were included.

Suspicion quickly turned to Serasa Experian, the São Paulo subsidiary of the London-listed credit bureau Experian, because many of the leaked fields resemble data held by credit reporting companies. The company has denied that its systems were compromised, and no organization has been formally held responsible for the leak.

January 20, 2021: Brazilian cybersecurity firm PSafe reported discovering a dataset with records of more than 220 million people being traded on a dark web forum.

January 28, 2021: Consumer protection agency Procon-SP notified Serasa Experian and demanded explanations about the leak, according to Brazilian press reports.

February 8, 2021: Experian told Reuters it was investigating whether the data was connected to Serasa and said there was no indication that its technological systems had been breached.

What Information Was Compromised?

Our analysis found the following data types in this breach:

Social Security Number (CPF), in 223,739,215 records

Name, in 223,739,216 records

Not every individual is affected by every type of data listed here.

Independent researchers who examined the wider archive reported additional categories of information, including dates of birth, addresses, phone numbers, salary ranges, credit scores and, in some samples, facial images. Reporting by Reuters noted that the data for sale also included vehicle registration details and social media account credentials, which Experian said Serasa does not collect or store. These wider fields come from external reporting rather than our own indexed catalog, so we treat them as unverified for this listing.

What Are the Potential Risks for Affected Individuals?

A CPF number and a full name are core building blocks for fraud in Brazil. Unlike a password, a CPF cannot be changed, so exposure persists indefinitely. Criminals can use these identifiers to attempt account openings, loan applications and fraudulent registrations in a victim's name. Researchers have also warned that the data is well suited to phishing, since a caller who knows a person's CPF and other details can pose more convincingly as a bank or government official. Affected individuals should watch for unexpected credit activity and treat unsolicited contacts asking for personal or financial details with suspicion.

What Is Serasa Experian Doing in Response?

Experian said in February 2021 that it was investigating whether the leaked data was connected to its Brazilian subsidiary and stated that, despite thorough investigations, there was no indication its systems had been breached. Brazilian authorities and consumer protection bodies, including Procon-SP, sought explanations from the company. A group action relating to the 2021 leak has since been filed in the English High Court against members of the Serasa Experian group, according to the law firm Mishcon de Reya. No organization has been proven liable for the compromise.

What Should You Do If You Were Affected?

If your data was part of the leak, take these practical steps:

Check your credit records and banking statements regularly for activity you did not authorize.

Register for alerts or monitoring services where available, and report suspected fraud to your bank and to Brazilian authorities.

Be cautious with calls, emails or messages that reference your CPF or other personal details; verify the caller independently before sharing anything.