A major data breach at FacePass, a Brazilian identification app, has exposed over 1.6 million files containing sensitive user information and company system credentials, according to findings from the Cybernews research team. The breach occurred through an exposed AWS S3 bucket, potentially compromising the personal data of numerous Brazilian citizens.
The leaked data includes Brazilian national IDs, verification selfies, AWS access credentials, full names, CPF numbers (Brazilian tax identification), and phone numbers. This breach is particularly concerning given Brazil’s recent push toward digital identification systems, as evidenced by the country’s implementation of biometric verification technology in various sectors.
Security experts warn that the exposed information creates significant risks for identity theft, financial fraud, and targeted phishing attacks. Cybercriminals could potentially pair national ID details with selfies to spoof biometric verification systems, for example.
The breach also exposed FacePass’s AWS credentials, potentially allowing unauthorized access to company systems. This security lapse is particularly noteworthy given recent improvements in AWS security features, including enhanced Identity and Access Management (IAM) protocols.
Following notification by the Cybernews research team, FacePass has reportedly addressed the security vulnerability. However, the company has not yet issued an official statement regarding the incident.
The incident highlights the broader challenges facing companies handling sensitive biometric and personal identification data, a concern that has been growing across the digital identity sector. Users of FacePass and similar identification apps are advised to monitor their accounts for any suspicious activity and remain vigilant about potential identity theft attempts.
Source: Cybernews
—
March 26, 2025 – by Ji-seo Kim
