The personal information of 92 million Brazilian citizens has been discovered for sale to the highest bidder on an underground forum auction. 

According to BleepingComputer, the auction is present on multiple dark web marketplaces that can only be accessed by paying a fee or via an invitation from someone who is already on the inside. 

The information is being sold as a 16GB database in SQL format and has a starting price of $15,000 and a step-up bid of $1,000. According to its seller, X4Crow, the records include names, dates of birth, taxpayer IDs, and some address details. 

A sample of the database, which was seen and verified as genuine by BleepingComputer, also contained information relating to gender and the names of individuals’ mothers. 

The origin of the database is unclear, though the inclusion of the taxpayer IDs and the seller’s claims that it contains the unique information of 92 million Brazilian citizens could indicate that it’s a government database of the approximately 93 million Brazilians who are currently employed. 

In addition to offering the data for sale, X4Crow claims that they can retrieve data available in national identification documents, such as ID cards and driving licenses, together with phone numbers, email addresses, previous addresses, professions, education levels, and vehicles. And all they need to do it is the individual’s full name, taxpayer ID, or phone number.  

Under Article 18 of the Brazilian General Data Protection Law (“Lei Geral de Proteção de Dados” or “LGDP”), consumers have rights relating to their data, and organizations need to ensure personal data is anonymized, redacted, or eliminated. Unfortunately, the law does not go into effect until August 15, 2020, a six-month extension from the previous February 2020 date.

Jonathan Deveaux, head of enterprise data protection with comforte AG, believes that in the future, companies may rely more on methods like tokenization to protect valuable consumer data. 

He said: “An emerging best practice among many technology leaders is to adopt a data-centric security approach, which protects personal data with anonymization technology like tokenization.

“Not only does tokenization allow organizations to meet compliance requirements and remain secure, but tokenization also allows organizations to securely embrace modern technology like hybrid or multi-cloud computing, which has been scrutinized as having major data security gaps.”