Caixa Seguridade Participações S.A. said in a Nov. 12 notice to the market that its investee Caixa Vida e Previdência reported a cybersecurity incident on Nov. 11, 2026, to Brazil's National Data Protection Authority, other authorities, and affected people¹.

The life and pensions unit, known as CVP, said it identified on Nov. 6 that it had been subject to unauthorized access and that personal and customer registration data had been copied outside its technology environment¹.

After identifying and blocking the mechanisms used in the attack, CVP said it added protective measures, started a forensic investigation with an outside firm, and began monitoring the internet for possible exposure of the data¹.

Analyses so far confirmed exposure of names and CPF numbers, Brazil's individual taxpayer IDs, from CVP's registration database, which includes current and former customers and covers all of its 7.6 million active customers¹.

Some records also included addresses, telephone numbers, email addresses, and dates of birth, the company said¹.

Based on a preliminary assessment, Caixa Seguridade said there was no evidence that financial or authentication data was compromised, including policy amounts, pension plan balances, banking information, or passwords¹.

CVP said it is notifying affected people whose mobile numbers or email addresses were exposed, as well as vulnerable groups, and is giving recommended steps against fraud, with a dedicated email for inquiries¹.

The notice, signed in Brasília by CFO and investor relations officer Edgar Vieira Soares, said Caixa Seguridade would keep the market informed of any material developments¹.

The filing does not name an attacker, describe how access was obtained, or say whether copied data has appeared online¹.