Brazil's deposit-guarantee fund has disclosed unauthorized access to personal information linked to its guarantee-payment process, ten calendar days after it first detected a suspected security incident. The Fundo Garantidor de Créditos (FGC) made the incident public on November 5, saying that it had restricted access to affected environments and notified the country's data-protection authority. But the fund has not established that the information was copied, published or misused, and the scope of the intrusion remains under investigation.
An October alert became a November disclosure
In its November 5 statement, FGC said it identified a suspected incident on October 26, 2026. It described unauthorized access to personal information in environments connected to internal processes for paying guarantees. The statement does not identify the person or group responsible, describe a route of entry or establish that every part of the fund's technology estate was compromised.
FGC said it restricted access to the affected environments, disabled improper accounts, preserved evidence and began reviewing permissions and security controls. Outside specialists are assisting its inquiry. The disclosure was dated November 5, ten calendar days after the date on which the fund says it first identified the suspicion; the dates alone do not show when all facts about the personal-data impact became known.
Brazilian financial outlets including InfoMoney and CNN Brasil reported the incident on November 5. FGC's own public notice is the primary record for the timeline and the actions it says it took.
Sources: Comunicado importante — Incidente de segurança (updated November 5, 2026) · FGC comunica vazamento de dados de investidores e alerta para risco de golpes · FGC comunica vazamento de dados pessoais de clientes, incluindo CPF · FGC informa ‘acesso não autorizado’ a seu sistema e vazamento de dados pessoais
Which information was involved
The fund lists names, CPF taxpayer-identification numbers, email addresses and dates of birth among the personal information involved. It also names information about taxes withheld from guarantee payments and the distribution channel through which a protected investment was originally made at a liquidated institution.
These categories matter together. A name and email address can help target a message; a CPF and date of birth can make that message sound familiar; a reference to an investment channel or tax withholding can make a bogus refund request look specific. This is a hypothetical risk, not a confirmed scam.
FGC has not disclosed how many people were affected, which failed institutions' records were involved or exactly what an intruder could retrieve. It says the categories differ across individual records and affected people can seek details through official support channels. Crucially, unauthorized access is not proof that a data set has been publicly dumped, sold or used to steal money.
Sources: Comunicado importante — Incidente de segurança (updated November 5, 2026) · FGC comunica vazamento de dados de investidores e alerta para risco de golpes · FGC comunica vazamento de dados pessoais de clientes, incluindo CPF
Why a deposit guarantee fund holds sensitive details
FGC operates a protection mechanism for certain deposits and investments at participating Brazilian financial institutions. Under its published ordinary-guarantee rules, eligible claims generally have a limit of R$250,000 per CPF or CNPJ for each institution or financial conglomerate, with an aggregate limit of R$1 million over four years. Those limits describe protection against specified institutional failures; they are not a measure of the losses caused by this cyber incident.
Processing a guarantee involves knowing who is entitled to be paid and how that entitlement was established. The sensitivity is therefore not confined to passwords or payment-card numbers. Context that helps a legitimate institution identify a creditor could also help an impostor impersonate it.
The incident should not be mistaken for evidence that the FGC's deposit-protection promise has failed, or that all customers of every member bank were affected. Its stated perimeter is information in environments related to guarantee-payment processes.
Sources: Comunicado importante — Incidente de segurança (updated November 5, 2026) · Sobre a garantia FGC: limites de cobertura
What the ten-day interval does — and does not — establish
October 26 to November 5 is a ten-calendar-day interval between the suspicion identified by FGC and the public statement. Yet the public-disclosure date, the date of notification to affected individuals and the date of notification to the regulator are not necessarily the same, and the public statement does not provide a complete chronology of those separate steps.
Brazil's National Data Protection Authority, ANPD, says controllers generally must notify it and affected individuals within three working days when an incident meets the applicable significant-risk threshold, subject to specific-law exceptions. The regulatory clock turns on the controller's knowledge that personal data was affected, not simply the first suspicion that a system may have been accessed. The fund says ANPD was notified, but has not specified the notification date or the date it reached that level of knowledge.
On the available evidence, the ten-day gap is a documented public-communication interval, not a proven breach of the LGPD or ANPD rules. Assessing compliance would require a dated sequence of discovery, confirmed personal-data impact, risk assessment and legally relevant notifications.
Sources: Comunicado importante — Incidente de segurança (updated November 5, 2026) · FGC comunica vazamento de dados de investidores e alerta para risco de golpes · FGC informa ‘acesso não autorizado’ a seu sistema e vazamento de dados pessoais · Comunicação de Incidente de Segurança: prazo e requisitos
Containment, reassurance and the risk of convincing scams
FGC says it has found no evidence so far that the information was improperly disclosed or used, and no financial losses arising from the event. The phrase 'so far' matters. Investigators are still checking whether records were copied or disseminated.
The fund says affected individuals have been notified and advises them to be wary of calls, emails and messages invoking their identity or a guarantee payment. It specifically warns against requests for fees, passwords, authentication codes or installation of applications, even if the person contacting them appears to know accurate personal details. According to its guidance, people should navigate directly to the official FGC application rather than follow a link in a suspicious message.
Anyone who receives a suspicious approach can preserve the message, check the claim with FGC through an official channel and report attempted fraud to the appropriate authorities. This is not a reason to share more identifiers with unsolicited callers. InfoMoney separately highlighted the fund's warning that it does not require a payment to release a guarantee.
Sources: Comunicado importante — Incidente de segurança (updated November 5, 2026) · FGC comunica vazamento de dados de investidores e alerta para risco de golpes · FGC comunica vazamento de dados pessoais de clientes, incluindo CPF
The unanswered questions now matter most
The next useful public update would establish the number of affected people, which categories were accessible in which systems, and whether forensic work finds copying or further distribution. It would also clarify when the fund determined that personal data had been affected, when it notified ANPD, and when individualized notices were delivered. None of those dates or figures should be inferred merely from the day the website notice appeared.
Another unresolved issue is whether any related services or payment operations were disrupted. FGC's statement reports no financial loss from the incident, but it does not supply an independently verified account of system availability, forensic findings or attribution.
For investors, the practical lesson is narrower and more immediate than a sweeping claim of systemic failure: a credible-looking message can still be fraudulent, particularly if it mentions real personal details. For institutions, the incident raises a question of how quickly a developing security investigation can yield clear, usable warnings without overstating what investigators know. The answers depend on evidence FGC has yet to publish.
Sources: Comunicado importante — Incidente de segurança (updated November 5, 2026) · FGC comunica vazamento de dados de investidores e alerta para risco de golpes · FGC informa ‘acesso não autorizado’ a seu sistema e vazamento de dados pessoais · Comunicação de Incidente de Segurança: prazo e requisitos · Sobre a garantia FGC: limites de cobertura
