Dec 28, 2025, 06:56 PM
This data breach emerged between January and February 2021, as a result of security failures in systems integrated with the RNDS (Rede Nacional de Dados em Saúde), operated by the Ministry of Health, which were responsible for processing and storing COVID-19 vaccination data. The exposure occurred due to misconfigured APIs and data repositories (datalake/buckets), allowing unauthorized access to sensitive information of Brazilian citizens.
The database below contains more than 521,014,289 records in total, with 182,958,107 unique individuals, identified based on the CPF field. It includes sensitive information related to COVID-19 vaccination, such as CPF, CNS, patient name, mother’s name, date of birth, biological sex, phone number, email, and full address, in addition to vaccination data like vaccine name, manufacturer, batch, dose number and description, and application date, as well as healthcare facility information, municipality, state (UF), source system, and RNDS/datalake import dates.
This dataset originates from the RNDS (Rede Nacional de Dados em Saúde), exposing personal and medical records of Brazilian citizens.
=================== SCHEMA ===================
sqlite> .schema
CREATE TABLE IF NOT EXISTS "DADOS" (
"VacinaNumDose" INTEGER,
"PacienteEnderecoCep" TEXT,
"PacienteRacaCorValor" TEXT,
"PacienteTelefone" TEXT,
"VacinaFabricanteReferencia" TEXT,
"DataImportacaoRnds" TEXT,
"PacienteNacionalidadeEnumNacionalidade" TEXT,
"PacienteCpf" INTEGER,
"Timestamp" TEXT,
"VacinaProfissionalAplicador" TEXT,
"PacienteEmail" TEXT,
"PacienteRacaCorCodigo" INTEGER,
"DtDeleted" TEXT,
"PacienteEnderecoCoPais" INTEGER,
"VacinaNome" TEXT,
"PacienteIdade" INTEGER,
"IDSistemaOrigem" INTEGER,
"EstalecimentoNoFantasia" TEXT,
"PacienteID" TEXT,
"DocumentID" TEXT,
"EstabelecimentoRazaoSocial" TEXT,
"PacienteNomeMae" TEXT,
"PacienteEnumSexoBiologico" TEXT,
"Status" TEXT,
"VacinaDataAplicacao" TEXT,
"VacinaGrupoAtendimentoNome" TEXT,
"SistemaOrigem" TEXT,
"EstabelecimentoMunicipioNome" TEXT,
"VacinaCategoriaNome" TEXT,
"DataImportacaoDatalake" TEXT,
"EstabelecimentoValor" INTEGER,
"PacienteEnderecoNmPais" TEXT,
"VacinaCodigo" INTEGER,
"VacinaFabricanteNome" TEXT,
"PacienteCns" REAL,
"VacinaProfissionalAplicadorNome" TEXT,
"EstabelecimentoUf" TEXT,
"Version" INTEGER,
"PacienteEnderecoNmMunicipio" TEXT,
"EstabelecimentoMunicipioCodigo" INTEGER,
"VacinaCategoriaCodigo" INTEGER,
"PacienteEnderecoBairro" TEXT,
"PacienteNome" TEXT,
"PacienteEnderecoUf" TEXT,
"PacienteEnderecoCoIbgeMunicipio" INTEGER,
"VacinaGrupoAtendimentoCodigo" INTEGER,
"PacienteDataNascimento" TEXT,
"VacinaDescricaoDose" TEXT,
"VacinaLote" TEXT
);
CREATE INDEX idx_dados_pacientecpf ON DADOS (PacienteCpf);
CREATE INDEX idx_dados_pacientenome ON DADOS (PacienteNome);
CREATE INDEX idx_dados_pacientetelefone ON DADOS (PacienteTelefone);
CREATE INDEX idx_dados_pacienteemail ON DADOS (PacienteEmail);
sqlite> SELECT COUNT(*) FROM DADOS WHERE PacienteCpf IS NOT NULL;
521014289
sqlite> SELECT COUNT(DISTINCT PacienteCpf) FROM DADOS;
182958107
sqlite> select * from DADOS limit 1;
1|76974|BRANCA|[5569984539672, 556984355008]|Organization/33781055000135|2021-06-14T15:58:18.000Z|B|58038965272|2022-02-05T02:51:39.161Z|Practitioner/210174178320008||1||10|COVID-19 ASTRAZENECA/FIOCRUZ - COVISHIELD|58|16341|HOSPITAL MUNICIPAL VANESSA E VANIA FUZARI|3d27b4a526ba5d189de669c18c37ef70819ee78f740fb068413594173cb5612a|00039503-d98d-47b6-a7a2-33993b1446eb-i0b0|PREFEITURA MUNICIPAL DE ALTA FLORESTA DOESTE|CLARA ANNA EMILIA BEHREND POSSMOSER|F|final|2021-06-07T00:00:00.000Z|Pessoas de 18 a 64 anos|Novo PNI|ALTA FLORESTA D'OESTE|Faixa Etária|2021-06-14T17:07:22.000Z|2679477|BRASIL|85|ASTRAZENECA/FIOCRUZ|706207560302663.0|JUCILENE DA SILVA ROSSIN|RO|1|ESPIGAO D'OESTE|110001|2|LIBERDADE|MELINA POSSMOSER|RO|110009|201|1962-10-08|1ª Dose|212VCD003ZVAA
=================== FILE INFO ===================
NAME: COVID-2023.db
FORMAT: .sqlite
SIZE: 394G
COVID-2023.db: SQLite 3.x database, last written using SQLite version 3045001, file counter 8, database pages 103156332, cookie 0x8, schema 4, UTF-8, version-valid-for 8
