Incident · Junior
Pix key data exposure at a participant (Pefisa, 2025–26)
The data was exposed for about 6 months and was only registration data. The exercise is to discuss what anomalous-read detection and auditing would have reduced the blast radius.
Short answer
The data was exposed for about 6 months and was only registration data. The exercise is to discuss what anomalous-read detection and auditing would have reduced the blast radius. The Central Bank of Brazil published a statement about an incident involving Pix keys of customers of some institutions.
01 · CONTEXT
A Central Bank notice about Pix key data
The Central Bank of Brazil published a statement about an incident involving Pix keys of customers of some institutions. The data was in Pefisa's custody and responsibility and was exposed by isolated failures in its systems. The text of the statement is the source for this case.
According to the statement, an unauthorized third party obtained a limited set of information about Pix keys, from August 30, 2025 to February 27, 2026.
The data was in Pefisa's custody and responsibility.
The statement attributes the exposure to isolated failures in the institution's systems.
An unauthorized third party obtained a limited set of information, from August 30, 2025 to February 27, 2026.
The information obtained is exclusively registration data, and passwords, transactions, and balances were not accessed.
The Central Bank reported the incident to the National Data Protection Authority.
02 · WHAT WAS EXPOSED
Registration data, with no password or balance
The information obtained is, in the statement's words, exclusively of a registration nature: name, CPF, institution of relationship, branch, account, account opening date, and Pix key dates. Passwords, transactions, and balances were not accessed.
| Pergunta | What the statement says |
|---|---|
| What data was obtained? | Name, CPF, institution, branch, account, account opening date, and Pix key creation and ownership dates |
| What was not accessed? | Passwords, transactions, and balances, nor other banking, tax, or asset information |
| Can money be moved? | They do not allow payments or transfers, nor access to the account |
| What risk remains? | Misuse of the data in scam or fraud attempts |
The Central Bank also reported the incident to the National Data Protection Authority (ANPD).
03 · BULK READING
What the DICT manual calls a scan attack
The DICT Operational Manual, for the Pix directory of transactional account identifiers, defines a scan attack as the capture of existing links in the directory for purposes other than making payments. It can be carried out by a user or by an intruder using the participant's infrastructure. The attack can be fast and intense, within a few hours, or slow, over days or months.
The DICT limits key queries based on two indicators: queries that did not result in a payment order and queries to unregistered keys. The mechanism is a token bucket. With an empty bucket, the requester receives a rate-limit error and cannot query until tokens are replenished.
| Camada | Controle |
|---|---|
| DICT: limiting | Limits key queries with a token bucket |
| Participant: internal limiting | Own policy equal to or stricter than the DICT's |
| Participant: authentication | Query restricted to a logged-in environment, with at least login and password |
| Participant: monitoring | Tracks queries over short and long periods to identify and block suspicious cases |
| Participant: existence cache | Does not store the key in clear text, the holder's data, or the account's data |
04 · DEFENSIVE DESIGN
How the layers combine
The diagram puts the manual's layers into a single query path. It is a study drawing made from the public rules, not the architecture of the affected institution.
A key query is only accepted from an authenticated customer, in a logged-in environment.
The institution applies an internal limiting policy equal to or stricter than the DICT's and does not forward to the directory queries that blow through the bucket limit.
The existence cache is for the institution's internal use, for example in controlling the query bucket, and does not store the key in clear text or the holder's data.
The directory applies its own token bucket limiting, based on two query indicators.
Monitoring tracks customers' requests over short and long periods, to identify and block suspicious cases.
The manual asks for tracking the ratio between the volume of DICT queries and the sending of orders to the SPI, and says that much higher values may indicate scan attack behavior. It is up to each participant to determine the usual ratio from the user journey and historical data.
05 · FOOD FOR THOUGHT
What to take to your own system
The Central Bank states that it adopts strict rules to limit requests and access to information by Pix participants and that it requires a high standard of personal data protection, with constant monitoring.
Three questions apply to any system that stores third-party data: which data does it need to store in clear text, who can read it and at what pace, and who notices when the read pattern deviates from normal. Answering the third requires monitoring and observability, and the first is a compliance and privacy decision made in the design.
Frequently asked questions
What is Pix key data exposure at a participant (Pefisa, 2025–26)?
The data was exposed for about 6 months and was only registration data. The exercise is to discuss what anomalous-read detection and auditing would have reduced the blast radius.
What does the Pix key data exposure at a participant (Pefisa, 2025–26) design cover?
It is organized in these sections: A Central Bank notice about Pix key data, Registration data, with no password or balance, What the DICT manual calls a scan attack, How the layers combine, and What to take to your own system.
How long is Pix key data exposure at a participant (Pefisa, 2025–26) and what level is it?
It takes about 9 minutes to read and is rated Junior level.
Now design it yourself
Run this case as an interview in the System Design school: you make the decisions, the tutor challenges them and you see how your design scores.