Brazilian Crowdfunding Platform APOIA.se Exposes 450K Email, Name, and Physical‑Address Records
What Happened — In December 2025 a database from APOIA.se, a Brazilian crowdfunding service, was posted on a public forum. The company confirmed in January 2026 that the breach disclosed roughly 451 000 unique email addresses together with names and physical addresses.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate data‑protection controls (classification, encryption, and access monitoring) that a continuous control‑assurance program is built to detect and evidence.
- Highlights the need for documented consent and privacy‑rights processes that can be presented as audit‑ready evidence.
- Shows how a single data‑exposure incident can trigger multiple regulatory obligations (e.g., GDPR‑style privacy notices, DSAR handling) across frameworks.
Who Is Affected – Primarily users of the crowdfunding platform (individual donors and campaign creators) in Brazil and any downstream services that integrated with APOIA.se.
Recommended Actions
- Map the breach to your data‑protection control objectives and collect evidence of encryption, access‑logging, and retention policies.
- Verify that consent records and privacy notices cover the exposed data categories; update where gaps exist.
- Prepare DSAR (Data Subject Access Request) response procedures and test them against the exposed records.
- Implement continuous monitoring of database access and privileged‑account activity to detect future anomalies.
Source: Have I Been Pwned – APOIA.se breach
Technical Notes – The breach was disclosed via a public forum dump; the exact attack vector (e.g., misconfiguration, credential compromise) was not identified. Exposed data types: email addresses, full names, and physical mailing addresses.
Source: same as above