Breaches and incidents
Prefeitura de Sao Paulo / Smart Sampa: surveillance system credentials and data exposed in a public repository for about 11 months
Per UOL reporting summarised by Tecnoblog, a public repository held 181 login and password combinations, registration data of more than 6,000 agents and...
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- Per UOL reporting summarised by Tecnoblog, a public repository held 181 login and password combinations, registration data of more than 6,000 agents and material allowing access to streams from part of the programme’s more than 58,000 cameras, plus queries by name, CPF and vehicle plate, for about 11 months; CNN Brasil says data of more than 58,000 cameras was exposed.
- Root cause: the city says a municipal employee who already had authorised access “divulgou informacoes do sistema ilegalmente”; it denies any weakness in the platform and says the repository did not mention access passwords, which conflicts with UOL’s reporting.
- No attacker named (the city attributes the disclosure to the employee).
- The employee was suspended and is under GCM internal-affairs investigation, the material was taken offline, MP-SP opened a preliminary “Noticia de Fato”, and ANPD told CNN on 21 Oct it had not been notified by the city.