Barato Coletivo · Breach

Threat actor claims leak of 980K Barato Coletivo users' data

Nov 02, 2026 · 1 min read

A threat actor on an underground forum claims to have posted a database from Barato Coletivo, a Brazilian group-buying site, with data on 980,000+ users: CPF numbers, emails, phone numbers, IP and physical addresses, and bcrypt password hashes. The claimed breach date is October 14, 2026; the company has not confirmed the incident and the claim is unverified. If confirmed, the case may fall under Brazil's LGPD notification rules, and the data exposes customers to PIX scams and fake-boleto phishing.

By HIFY Radar newsroom Updated 11/02/2026 04:40 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A threat actor on an underground forum claims to have leaked a Barato Coletivo database with data on 980,000+ users, including CPF numbers, emails, phone numbers, addresses and password hashes. The claimed breach date is October 14, 2026. The company has not confirmed the incident.

Why it matters

If confirmed, CPF numbers combined with contact and address data enable PIX scams, fake-boleto phishing and identity fraud against the site's customers in Brazil. DailyDarkWeb says the data appears to be shared openly, widening exposure, and the case may fall under LGPD notification rules.

What to do

Have threat intelligence verify the database and track confirmation of the claim. If confirmed, trigger the LGPD notification process and urge customers to change passwords and distrust PIX charges and boletos.

For the technical team

Affected: Barato Coletivo, site brasileiro de compras coletivas; base alegada de usuários · Alleged user database of the Barato Coletivo site: 980,000+ records with CPF numbers, emails, phone numbers, IP and physical addresses, and bcrypt password hashes.
Exploitation: Unverified claim posted by a threat actor on an underground forum and reported by DailyDarkWeb; the channel says the data appears to be shared openly. The company has not confirmed an incident.
Fix: Not applicable to a data leak.
More details: The actor cites bcrypt hashes 'and more' and a breach date of October 14, 2026. DailyDarkWeb analyst note: bcrypt slows cracking but weak passwords remain at risk; the case may fall under LGPD if confirmed. DailyDarkWeb's full source is subscribers-only.