Brazilian recruitment platform CIEE leaks 248 K records
Learn More
CIEE (Centro de Integração Empresa-Escola), a Brazilian recruitment and selection platform has exposed personal information of hundreds of thousands of users. The leak was publicized when threat actor "888" published over 248,725 records containing sensitive personally identifiable information stolen from the platform. The threat actor has a credible reputation on the Dark Web for conducting large-scale data breaches, and has successfully targeted corporations including Microsoft, BMW (Hong Kong), and others in the tech, freight, and oil & gas industries.
CIEE One serves as a recruitment service connecting candidates with major Brazilian corporations, including top financial institutions, energy companies, oil & gas providers, telecommunications firms, and technology companies. According to the CIEE official website, the service "connects talent with the largest companies" in Brazil.
The root cause of the breach was identified as a misconfigured Google Cloud Storage bucket that was publicly accessible without authentication. During a security assessment of cloud resources, a misconfigured publicly accessible Google Cloud Storage bucket (ciee-storage.storage.googleapis.com) belonging to CIEE was discovered. The investigation revealed that the exposed bucket contained over 364,000 files totaling approximately 28 GB in size, significantly larger than the initial dataset published by the threat actor.
The exposed data includes:
- Full names (Nome Completo)
- Postal codes and addresses (CEP, Bairro, Cidade, Estado)
- Email addresses
- Phone numbers (Telefone)
- CPF numbers (Brazilian individual taxpayer identification numbers)
- Registration dates (Data de Cadastro)
- Age information
- Personality profiles
- Educational background (Formação)
- Employment status and hired positions
- Professional experience records
- Medical reports and evaluations (2,838 PDF files)
- Profile pictures (281,912 JPEG/PNG files)
- Job application videos (~8,000 MP4/MOV files)
- Curriculum vitae and resumes (~40,000 PDF/JPEG files)
- Internal tracking sheets and operational data (264 Excel documents)
- Biometric data including facial recognition information
The number of affected individuals was initially reported as 248,725 records, but the full investigation revealed exposure of over 364,942 files. As of July 2, 2025, the issue had not been contained, allowing the threat actor to continue collecting exposed PII. Resecurity validated the authenticity of the stolen data and contacted multiple victims who confirmed they were registered users at CIEE.
Resecurity notified CERT.br regarding this matter on July 2, 2025, and shared actionable intelligence about the identified vulnerability that led to cloud bucket data exposure.
