Portal do FGTS · Breach

Threat actor claims sale of 1.5 million FGTS records

Oct 27, 2026 · 1 min read

A threat actor is offering on an underground forum a dataset of more than 1.5 million records they claim was taken from Brazil's FGTS portal. The actor's samples allegedly include full names, CPF and PIS numbers, work booklet data, employer CNPJ, salary history and FGTS balances. Authorities have not confirmed an incident; workers should distrust unsolicited FGTS contacts and use only official Caixa channels.

By HIFY Radar newsroom Updated 10/27/2026 05:56 AM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A threat actor is offering on an underground forum a dataset of more than 1.5 million records they claim was taken from Brazil's FGTS portal. The samples allegedly include full names, CPF and PIS numbers, work booklet data, employer CNPJ, salary history and FGTS balances. No authority has confirmed the incident.

Why it matters

If real, Brazilian workers face fake benefit-withdrawal, loan and 'FGTS release' scams, since CPF and PIS numbers appear alongside salary and balance data. The claim involves a federal fund and carries reputational and trust risks. The case remains unverified pending official confirmation.

What to do

Warn employees and customers to distrust unsolicited calls, SMS and WhatsApp messages about FGTS and use only official Caixa channels. Monitor support channels for scam reports. Track official confirmation or denial of the incident.

For the technical team

Affected: Portal do FGTS (Fundo de Garantia do Tempo de Serviço), fundo federal de garantia e benefícios trabalhistas do Brasil · FGTS portal (Fundo de Garantia do Tempo de Serviço), per the actor's claim. Versions not applicable.
Exploitation: No technical exploitation reported. The dataset sale was announced on an underground forum and reported by DailyDarkWeb on 2026-10-27. Unverified claim; authorities have not confirmed an incident.
Fix: No fix; no confirmed vulnerability or intrusion. Source-recommended mitigation: treat unsolicited FGTS contacts with suspicion and use only official Caixa channels.
Vector: Method unknown. The actor claims the records were taken from the FGTS portal; the source gives no details on the flaw exploited or access conditions.
More details: The actor's samples allegedly include full names, dates of birth, CPF, PIS, CTPS work booklet details, employer CNPJ, salary history, FGTS balances and hiring and termination dates. DailyDarkWeb analyst note: CPF and PIS paired with salary and FGTS balance data are ideal for fake benefit-withdrawal, loan and 'FGTS release' scams.