[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcB6IVaT1-BIDp0DzNP8DQg3sbMoLkBJJPp8s8w68eb0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":26,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":54},"055f2ab2-8fd0-4151-bc6b-27f16cb35698","brazil-sisvisa-health-database-left-79gb-of-sensitive-records-publicly-exposed","3bce5eb2-c797-4ba1-bbe3-9a1113426213","Brazil SISVISA Health Database Left 79GB of Sensitive Records Publicly Exposed","Brazil's SISVISA health surveillance system failed to implement even basic password protection on a publicly accessible database containing over 102,000 files and 79GB of sensitive personal and identity data. This represents a fundamental misconfiguration failure — no authentication barrier was placed between the public internet and highly sensitive government health records. The exposure of tax IDs, scanned identity documents, and personal contact information creates significant risks for identity theft and fraud affecting potentially thousands of individuals. The unknown duration of exposure compounds the risk, as there is no way to determine whether malicious actors harvested the data before access was revoked. This incident underscores that government health systems are high-value targets and must meet the same security standards expected of private sector data custodians.","**Immediate actions:**\n- Audit all internet-facing government databases and storage systems to confirm authentication and access controls are enforced.\n- Conduct a forensic review of access logs for the exposed SISVISA system to determine if unauthorized actors accessed the data.\n- Issue breach notifications to affected individuals in accordance with Brazil's LGPD data protection law.\n\n**Long-term improvements:**\n- Enforce a policy requiring mandatory authentication, encryption at rest, and access control reviews before any system containing personal data is deployed publicly.\n- Implement a data classification framework to ensure sensitive government records (PII, identity documents, health data) are automatically subject to heightened access restrictions.\n- Establish a recurring configuration audit schedule using automated tools to detect publicly exposed assets before they are discovered externally.\n\n**Detection measures:**\n- Deploy continuous attack surface monitoring tools to detect unauthenticated or misconfigured public-facing assets in real time.\n- Integrate cloud and server access logging with a SIEM platform to alert on anomalous bulk data access or unauthenticated requests.\n- Participate in responsible disclosure programs or bug bounty initiatives to enable external researchers to safely report misconfigurations.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25],"CIS Control 3: Data Protection","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 IA-2: Identification and Authentication","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","Brazil LGPD (Lei 13.709\u002F2018) Articles 46 & 48: Security and Breach Notification","GDPR Article 25: Data Protection by Design and by Default","GDPR Article 32: Security of Processing","ISO\u002FIEC 27001:2022 A.8.3: Information Access Restriction","ISO\u002FIEC 27001:2022 A.8.9: Configuration Management",{},"published","2026-08-05T12:21:52.61102+00:00","2026-08-05T12:21:52.305+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fhackread.com\u002Fbrazil-health-surveillance-database-exposed-records\u002F","brazil-health-surveillance-database-exposed-79gb-of-sensitive-records-f9027a","Brazil Health Surveillance Database Exposed 79GB of Sensitive Records",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":48,"name":49,"slug":50,"description":51,"color":52},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[55,59,63],{"slug":56,"name":57,"problem":58},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":60,"name":61,"problem":62},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":64,"name":65,"problem":66},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control."]