A total of 150 Pix keys belonging to SHPP Brasil Instituição de Pagamentos (Shopee) customers had their data exposed, the Central Bank (BC) reported on Wednesday (19). This was the 14th incident involving Pix data since the launch of the instant payment system in November 2020.
According to the BC, the exposure occurred from September 2 to 4 and covered the following information: user name, CPF, relationship institution, branch, account number and type.
According to the Central Bank, the exposure occurred due to specific failures in the payment institution’s systems. The exposure, the BC reported, occurred in registration data, which does not affect the movement of money. Data protected by bank secrecy, such as balances, passwords and statements, were not exposed.
Although the case did not need to be reported because of the low potential impact on customers, the authority clarified that it decided to disclose the incident in the name of its “commitment to transparency”.
All people whose information has been exposed will be notified via the app or internet banking of the institution. The Central Bank emphasized that these will be the only means of warning about the exposure of Pix keys and asked customers to disregard communications such as phone calls, SMS and notifications via messaging applications and e-mail.
Data exposure does not necessarily mean that all information has been leaked, but that it has been visible to third parties for some time and may have been captured. The Central Bank reported that the case will be investigated and that sanctions may be applied. The legislation provides for fines, suspension or even exclusion from the Pix system, depending on the severity of the case.
In all 14 incidents involving Pix keys recorded so far, registration information was exposed, without passwords or bank balances being exposed. As determined by the General Data Protection Law, the monetary authority maintains a page where citizens can monitor incidents related to the Pix key or other personal data held by the BC.
In May 2022, Shopee’s shopping app received authorization from the Central Bank to operate as a payment institution in Brazil. The report awaits a statement from the company.
