Unverified claim — July 17, 2026: Threat monitors say a cybercrime-forum actor is advertising a dataset allegedly tied to Brazil's Receita Federal (RFB) with 279,008,638 CPF/citizen records (~69.6GB), priced around $10,000 in crypto. The same listing plugs an older purported 2019 backup of ~248 million CPFs. This has not been confirmed by Receita Federal.
Brazil has lived through CPF mega-leak headlines before. Treat every new “entire population” sale as a claim until the tax authority, PF, or independent researchers attest the corpus.
What the July listing says
Per Dark Web Informer, the actor published two 10,000-row samples and described fields spanning CPF, full name, date of birth, email, phone, residential address, postal code, municipality, occupation, nationality, parents' names, sex, tax-registration dates, cadastral status, foreign-residency flags, and death-related records.
The June 248M episode Receita already denied
On June 10, 2026, monitors flagged a BuddhaGroup-linked sale claiming ~248 million citizens and 41+ million legal entities (~1.07 billion records across 24 SQLite files). TecMundo and Poder360 reported that Receita Federal denied that incident, calling circulating coverage fake news / no matching breach. The July seller's “2019 backup” figure rhymes with that denied marketing—another reason not to promote either set as confirmed RFB production theft.
What this is not
It is not a company or regulator attestation that RFB systems were breached in July 2026. It is not proof the 279M file is fresh, complete, or distinct from recycled Serasa/other historical Brazilian dumps that have circulated for years.
What Brazilians should do anyway
- Use official gov.br tools to monitor and restrict CPF-linked credit queries where available.
- Assume CPF + mother's name + DOB combos fuel bank KYC and loan fraud—verify any “Receita” or “regularize seu CPF” message out-of-band.
- Canonical record: Receita Federal CPF sale claim on BreachHistory.
Sources: Dark Web Informer; TecMundo; Poder360.