- A threat actor claims to sell 15 million rows of Brazilian user data for $20,000, with the price open to negotiation.
- The alleged dataset contains about 5 million email addresses, 5 million bank records, and 5 million phone numbers.
- SOCRadar reviewed sample rows that reference customers of major Brazilian banks, but no public source confirms the seller’s claim.
A large database with alleged banking and contact data from Brazil has appeared for sale for $20,000 on an underground forum. The seller claims the database holds 15 million rows from one source.
SOCRadar described the listing in its September 25 Dark Web News coverage. The seller says buyers can negotiate price, and is also willing to offer smaller parts.
However, no bank has publicly confirmed that the listing came from its systems. There’s currently no public statement from Brazil’s central bank that connects this specific listing to a bank breach.
Details of the Claimed Database
According to SOCRadar, the dataset splits into three main groups. Around 5 million records have email addresses. Another 5 million list bank information details like branch numbers, agency numbers, account numbers, and account type or status.
The last 5 million records include phone numbers. Altogether, that’s 15 million rows. But that doesn’t mean there are 15 million unique people. One person might show up in more than one category.
SOCRadar mentioned that some sample rows refer to customers of big Brazilian banks. Still, those samples alone don’t prove the banks provided the data. The seller claims everything comes from a single source, but so far, there’s no independent evidence to back that up.
The Data Source is Unclear
Large datasets sold on criminal forums can have unclear origins. A seller may know the source, but a forum post alone cannot prove it.
Criminals can also mix old leaks, exposed databases, stolen logins, and third-party data. Not too long ago, a separate dark web listing also claimed to offer millions of Brazilian bank records, as reported in Cybercriminal Claims Sale of 2.3 Million Brazilian Bank Records on Dark Web.
A database with bank account information does not prove that a bank suffered a new intrusion. The listing shows only that a seller claims to have the data. It does not show how or when the seller got it.
SOCRadar also conducts a wider study of attacks on financial organizations. In its research from 2023 to 2025, Brazil is identified as one of the countries under attack. SOCRadar also monitors forum postings offering stolen data.
Forum postings are often a threat indicator. However, a forum post requires validation before deeming it a confirmed threat.
Possible Implications of the Data Leak
If the data proves genuine, the combination could help criminals run more convincing scams. A phone number and email address can help an attacker reach a target. Account details could then help the attacker make a fake bank call or message sound real. The data could also support scams involving Pix, Brazil’s instant payment system.
The Banco Central do Brasil says victims of Pix fraud can ask their financial institution to start the Special Return Mechanism, known as MED. The bank must review the case. The process can help return funds when the rules allow it.
The central bank also requires banks to notify users after some data incidents tied to Pix systems. That rule does not link this dataset to Pix or any bank.
What’s Next?
The mix of account information, email addresses, and phone numbers could make social engineering more convincing if the data is real.
A scammer could pose as a bank employee and quote genuine-looking account details. The caller could then ask the victim to share a password, approve a transaction, install software, or move money.
Customers should not trust an unexpected call just because the caller knows details about their bank account. The Banco Central advises users to use official bank channels. Customers should use the bank app or a trusted phone number, not links in random messages.
Anyone who suspects a Pix scam should contact their bank quickly. Under current MED rules, a victim can ask for the process within 80 days of a fraud. A return depends on the case and funds still available.
The important part is whether researchers or Brazilian authorities can connect the information to a concrete company or hack. So far, there is no evidence of such a connection. The post is still a mere claim on an underground forum, not the confirmation of a data breach of Brazil’s banking industry.
Customers of Brazilian banks should be cautious anyway. They should verify the calls and messages, even if they contain personal account information.
A person who received a suspicious message should address the bank through the official communication channel. It is not recommended to share any passwords or codes. No payments should be made if the call comes from the bank.
There may be a case where 15 million rows are both new and old. There should be more evidence to find out the origin of the data and its credibility.
