BleepingComputer reported a data breach at Convertr (Brazil) on 27 October 2026, and it has been confirmed. Exposed: Financial account and card details, Expiration date, CVV code, Cardholder name and CPF taxpayer identification number.
Status
Confirmed breach
People affected
Not reported yet
Reported
27 October 2026
What was exposed
Financial account and card details
Expiration date
CVV code
Cardholder name
CPF taxpayer identification number
How it happened
Way in
Plausible the attacker modified the Plausible tracker file hosted on a self-managed server operated by Convertrsource
Attacker
Brazilian gang has been attributed to a Brazilian gang, active since at least July 2024source
From
Brazil, according to Sansec attributed to a Brazilian gangsource
Look for Convertr’s own notice or letter: it should say what of yours was involved. Keep it.
Call your bank on the number printed on your card (never one from a message), check recent payments and ask for a new card.
An ID number cannot be changed, so lock it: a credit freeze or fraud alert in the US, a credit warning (kreditadvarsel) on borger.dk in Denmark, Cifas protective registration in the UK.
Expect scams that use your details: calls, texts or emails pretending to be Convertr, your bank or the police. Never give codes or passwords, never approve a sign-in you did not start, never move money.
Privacy Unpacked