backOn April 24, XP Inc. informed its clients about a data breach involving unauthorized access to a database hosted by an external provider. According to the company, basic registration and financial information—such as names, emails, phone numbers, account balances, and credit limits for March—were compromised. XP emphasized that no sensitive data like passwords, CPF numbers, biometric information, or credentials enabling financial transactions were exposed. The company acted promptly to block the unauthorized access and assured that none of its internal systems were affected.
XP also warned clients to be cautious about potential scams involving the leaked data and advised against taking any action in the app based on phone calls claiming to be from the company. The firm reassured that its apps and websites remain secure, with no need to change passwords. The incident highlights the critical role of third-party risk management in personal data processing, in line with Brazil’s General Data Protection Law (LGPD).
share
