Vakinha Fundraising Platform Breach Exposes 4.8 M Brazilian Users' Personal Data
What Happened — In June 2020 the Brazilian crowdfunding service Vakinha suffered a data breach that leaked 4,775,203 user records. Exposed fields included email addresses, names, phone numbers, dates of birth, IP addresses and passwords stored as bcrypt hashes. The compromised dataset was later shared on hacking forums and added to Have I Been Pwned.
Why It Matters for Trust & Control Assurance
- Highlights the risk of insufficient credential‑storage controls and the need for continuous verification of password‑hashing algorithms.
- Demonstrates why documented privacy‑by‑design practices (consent, DSAR readiness) must be continuously monitored and evidentially maintained.
- Shows the value of an immutable audit trail that can prove timely detection, response, and remediation to auditors.
Who Is Affected — Primarily the Brazilian crowdfunding/financial‑services sector and any organization that stores similar personal identifiers and credential data.
Recommended Actions
- Review and harden password‑storage mechanisms; ensure bcrypt parameters meet current best‑practice recommendations.
- Refresh privacy notices, verify lawful consent, and conduct a DSAR readiness test.
- Deploy continuous monitoring for data‑exposure alerts and maintain immutable logs for audit evidence.
Technical Notes — The breach exposed personally identifiable information (PII) and bcrypt‑hashed passwords; no specific vulnerability or attack vector was disclosed. Source: Have I Been Pwned – Vakinha breach