Brazillian driving school exposes data of 400K via an unsecured Google Cloud Storage
Learn More
A Brazilian driving school, Centro de Formação de Condutores Free Alda in São Paulo, left a Google Cloud Storage bucket unprotected, exposing sensitive data from approximately 400,000 learner drivers.
The breach was discovered by researchers at Cybernews, who found personal details associated with Brazil's learner driving permits (Licença De Aprendizagem De Direção Veicular), including:
- Full names
- Photographs
- Postal addresses
- Government ID numbers and taxpayer numbers
- Driving permit details, such as issue dates and validity periods
- Signatures
- IP addresses and phone model information
The exposed data also contained a Detran insignia, referencing Brazil's State Department of Traffic (Departamento Estadual de Trânsito).
Although Cybernews reported this issue to Brazil's CERT shortly after discovering it on June 2, 2024, the archive reportedly remained accessible until at least September 19, 2024.
Due to the type and amount of data exposed, cybercriminals could potentially misuse this information for identity theft, fraud, and other malicious activities.
