Exposed SISVISA Database Leaks 102,000 Brazilian Health Surveillance Records
What Happened — A publicly accessible SISVISA database hosted by Brazil’s Health Surveillance Information System was found without any authentication or encryption. The exposed instance contained 102,215 files (≈ 79 GB) with personal identifiers, tax IDs, driver’s‑license scans, fingerprints, and regulatory inspection reports. Researchers were able to browse the “backups”, “imports”, “documents” and “uploads” folders simply by knowing the URL.
Why It Matters for Compliance & Audit Readiness
- The incident is a textbook example of a mis‑configuration that defeats SOC 2 CC6.1 (Logical Access Controls) and CC7.1 (System Operations) – controls that require documented authentication, encryption, and continuous monitoring of critical data stores.
- Continuous‑compliance programs must be able to prove that every production database is inventoried, access‑controlled, and that evidence of those controls is collected in real time; otherwise a breach like this leaves no audit trail.
- Mapping this gap to a SOC 2 control library and feeding the evidence into a Trust Center provides the defensible audit evidence regulators and partners expect.
Who Is Affected — Brazilian public‑health regulators, hospitals, restaurants, pharmacies, and any individuals whose personal or professional data were stored in SISVISA.
Recommended Actions
- Immediately inventory all production databases and verify that authentication, least‑privilege access, and encryption‑at‑rest are enforced.
- Map the database to SOC 2 CC6.1 and CC7.1 controls, capture configuration screenshots, and feed them into a continuous‑evidence collection system.
- Deploy automated mis‑configuration scanning for cloud‑hosted services and schedule periodic reviews to keep the control mapping up‑to‑date.
Technical Notes — The exposure resulted from a simple mis‑configuration: the web‑accessible database had no login requirement and stored unencrypted files. No known CVE or exploit was used. Data types included full names, home addresses, CPF/CNPJ tax IDs, driver’s‑license and federal doctor ID scans, facial photos, fingerprints, and inspection reports. Source: Security Affairs