Individual Taxpayer Registry

Profile narrative

The Individual Taxpayer Registry, known in Brazil as the Cadastro de Pessoas Físicas (CPF), functions as the primary tax identification system for natural persons under the administration of the Brazilian Federal Revenue Service (Receita Federal do Brasil). The registry assigns a unique eleven-digit number to each registered individual, including Brazilian citizens, resident foreigners, and non-residents with tax obligations in the country. This identifier serves as a foundational credential across public and private sectors, enabling tax compliance, social security contributions, and access to government services. Financial institutions require a valid CPF for opening accounts, issuing credit cards, and processing loans, while employers use it for payroll and labor registration. The system also supports electoral registration, public healthcare enrollment, and property transactions, making it a central component of Brazil's administrative infrastructure.

The scale of the registry reflects the size of Brazil's population and its economic activity, with hundreds of millions of records accumulated since its inception. The database maintains detailed personal information for each registrant, including full name, date of birth, parents' names, and address history, creating a comprehensive reference for identity verification. In January 2021, the Federal Police arrested a hacker known as "Vanda the God," identified as Marcos Roberto Correia da Silva, during Operation Deepwater for allegedly orchestrating the largest data breach in Brazil's history. The compromised dataset reportedly contained CPF numbers, Corporate Taxpayer Registry (CNPJ) details, full names, and addresses of approximately 223 million individuals, a figure exceeding the country's living population and suggesting the inclusion of historical or duplicate records. A second actor using the alias "JustBR" subsequently listed the stolen data for sale on RaidForums, prompting additional investigative warrants and highlighting the commercial value of the registry's contents on illicit markets.

As a government-maintained database, the CPF operates under strict regulatory oversight and data protection frameworks, including the General Data Protection Law (Lei Geral de Proteção de Dados) enacted in 2018. The Federal Revenue Service manages the registry's integrity, updates, and access controls, coordinating with other public agencies that rely on its data for policy implementation and service delivery. The 2021 breach exposed vulnerabilities in the broader ecosystem of entities authorized to query or process CPF data, prompting renewed scrutiny of data-sharing protocols and security standards across public and private partners. The incident underscored the registry's critical role as a national identity backbone and the systemic risks associated with its widespread integration into Brazil's digital economy.

Incidents

1 incident linked to this organisation.