A publicly accessible database belonging to Brazil’s Health Surveillance Information System (SISVISA) exposed 102,215 health records, including sensitive personal and regulatory documents, without requiring any authentication. Security researcher Jeremiah Fowler discovered the exposed instance and subsequently reported the findings.
The database, totaling approximately 79 GB of data, contained a wide array of information critical to Brazil’s health surveillance operations. This included full names, home addresses, phone numbers, CPF and CNPJ tax IDs, scanned driver’s licenses, federal doctor ID cards, photographs, fingerprints, inspection reports, complaint records, and compressed backup archives. The exposed folders were labeled "backups," "imports," "documents," and "uploads."
SISVISA is a vital platform utilized by Brazilian health authorities to oversee public health regulations, issue business permits, and manage inspections for various entities such as hospitals, restaurants, and pharmacies. The exposed data was not from a test environment but was directly integrated into the system's operational functions.
The lack of authentication meant that anyone with the database's URL could browse and access these sensitive files. This type of data could enable attackers to engage in phishing and impersonation campaigns, open new lines of credit, or cross-reference tax IDs with other breached datasets for further exploitation. There is also a risk that malicious actors could download the files, inject malware, re-upload them, or encrypt the entire system for ransom.
The SISVISA system, which replaced paper-based workflows in 2015, aimed to streamline application approvals and compliance tracking. However, the digital transition introduced new vulnerabilities, as evidenced by this exposure.
Upon discovering the vulnerability, Fowler promptly notified several government agencies. Public access to the database was disabled shortly after these alerts were sent. However, no official response was received, leaving it unclear how long the data had been exposed or whether any unauthorized parties had accessed it prior to its securing.
It remains unconfirmed whether the exposed database was managed directly by a government team or by a third-party provider. The incident highlights common cybersecurity challenges, including critical systems lacking proper authentication and encryption, and an unclear chain of responsibility for data security.
For individuals or organizations potentially affected by this leak, it is advisable to closely monitor financial accounts, treat unexpected communications referencing tax IDs or licenses with extreme caution, and enable multi-factor authentication wherever possible. The exposure of health surveillance data, including fingerprints and medical regulatory information, significantly elevates the risks of fraud and long-term identity abuse.
