Cadastro Nacional da Pessoa Jurídica

The Corporate Taxpayer Registry (CNPJ), also known as Cadastro Nacional da Pessoa Jurídica, operates as a critical Brazilian national registry for legal entities. It maintains taxpayer identification numbers and associated corporate records, functioning as an official repository for business-related data. The registry's scope encompasses the collection and management of sensitive information tied to corporate entities operating within Brazil's jurisdiction. This includes foundational identification details such as corporate taxpayer numbers, business names, and registered addresses. The CNPJ system serves as a mandatory registration mechanism for companies engaging in formal economic activities across Brazil.

A 2021 data breach highlighted the CNPJ's role in safeguarding high-value regulatory data. Federal Police investigations revealed that compromised records included CNPJ numbers alongside individual taxpayer IDs (CPFs), full names, and residential addresses—affecting hundreds of millions of citizens and businesses. The incident, described as Brazil's largest data leak, demonstrated the registry's systemic importance and the attractiveness of its datasets to cybercriminals. Operation Deepwater's arrest of a primary suspect exposed illicit trading of CNPJ records on underground forums, underscoring the registry's position as a high-risk target for large-scale data exfiltration. Authorities executed multiple search warrants to address the unauthorized dissemination of these confidential records, reflecting the CNPJ's integration within Brazil's broader tax administration infrastructure.