São Paulo's Smart Sampa surveillance leak exposed credentials and access to 58,000+ cameras for ~11 months
A public repository exposed sensitive data from Smart Sampa, the Prefeitura de São Paulo video surveillance system, for about 11 months, allowing unauthorized access to more than 58,000 cameras. Cameras covered sensitive sites such as daycare centers, schools, hospitals and drug-treatment centers. According to UOL, reporters used the exposed material to view live imagery and to access the platform of Sentinelx, the technology provider, without two-factor authentication. The city attributes the leak to a municipal employee acting illegally, who has been identified, suspended and is under investigation by the Guarda Civil Metropolitana internal affairs unit. The city denies any flaw in the platform's protection mechanisms. The data was removed from the public repository after the outlet raised the alert.
Technical Details
- The public repository held 181 valid logins and passwords of authorized users, data on more than 6,000 security agents, and instructions to replicate the system on computers and mobile devices.
- The credentials allowed querying personal data and database records: names, CPF numbers, vehicle license plates and police reports (boletins de ocorrência), as well as tracking the movement of agents and patrol vehicles.
- The Sentinelx platform could be accessed without two-factor authentication until the city reinforced it after being questioned.
- A technology expert cited by UOL said some interfaces could allow data insertion without properly verifying the sender's identity (not independently confirmed).
- The city states it does not have access to the source code, AI models or training datasets of the facial recognition component and does not conduct independent audits. Between November 2024 and May 2026, 268 people were taken to police stations after facial recognition alerts and later released (75 identification inconsistencies, 181 outdated warrants, 12 registry problems).
Remediation
- The city reports it has introduced unique passwords, two-factor authentication and SMS validation for creating new passwords.
- The exposed data was removed from the public repository.
- Defenders operating similar systems should rotate all exposed credentials, enforce MFA on all access paths, scan code repositories for secrets and audit access logs for the exposure window.
Linha do tempo
-
São Paulo's Smart Sampa surveillance leak exposed credentials and access to 58,000+ cameras for ~11 months
ler a análise desta fonte ocultar
A public repository exposed sensitive data from Smart Sampa, the Prefeitura de São Paulo video surveillance system, for about 11 months, allowing unauthorized access to more than 58,000 cameras. Cameras covered sensitive sites such as daycare centers, schools, hospitals and drug-treatment centers. According to UOL, reporters used the exposed material to view live imagery and to access the platform of Sentinelx, the technology provider, without two-factor authentication. The city attributes the leak to a municipal employee acting illegally, who has been identified, suspended and is under investigation by the Guarda Civil Metropolitana internal affairs unit. The city denies any flaw in the platform's protection mechanisms. The data was removed from the public repository after the outlet raised the alert.
Technical Details
- The public repository held 181 valid logins and passwords of authorized users, data on more than 6,000 security agents, and instructions to replicate the system on computers and mobile devices.
- The credentials allowed querying personal data and database records: names, CPF numbers, vehicle license plates and police reports (boletins de ocorrência), as well as tracking the movement of agents and patrol vehicles.
- The Sentinelx platform could be accessed without two-factor authentication until the city reinforced it after being questioned.
- A technology expert cited by UOL said some interfaces could allow data insertion without properly verifying the sender's identity (not independently confirmed).
- The city states it does not have access to the source code, AI models or training datasets of the facial recognition component and does not conduct independent audits. Between November 2024 and May 2026, 268 people were taken to police stations after facial recognition alerts and later released (75 identification inconsistencies, 181 outdated warrants, 12 registry problems).
Remediation
- The city reports it has introduced unique passwords, two-factor authentication and SMS validation for creating new passwords.
- The exposed data was removed from the public repository.
- Defenders operating similar systems should rotate all exposed credentials, enforce MFA on all access paths, scan code repositories for secrets and audit access logs for the exposure window.