Jun 06, 2026, 02:37 PM
Greetings Breachforums.
We (https://t.me/n_3_xl) hold high-priority target records from Creditas (creditas.com.br) complete with CPF (Brazilian taxpayer ID), full names, loan balances, and status.
Compromised Asset Inventory
85,000+ CPFs (→ 1M+ at the end of the dump)
170K+ company CNPJs
1,257+ mobile numbers
Validated credentials
Active OAuth tokens
Multiple accesses (GraphQL IDOR, SSRF, etc.)
Loss for Creditas: R$ 165–310 million
SAMPLE: https://privatebin.net/?85048f24dd86b8e6...MsueYTTtXr
Alongside 170,367 payroll company records (JSON), 135,947 reconciliation groups (pending payroll records reportedly used in the parent-account kill chain), 480 validated credentials (email:password:CPF) and 61 high-value debtors (BRL 40,000+) with mapped OTP-related information.
We know your weaknesses.. here’s how this ends badly for Creditas:
LGPD fines could cost Creditas millions in reais for non-compliance after this breach.
Borrowers could sue the company over exposed financial histories and active loans.
Security recovery would require budget in the millions to prevent further leaks.
A massive dump would crush customer trust, forcing high-risk clients to flee.
Reputation damage could bury Creditas for years.
FINAL WARNING FOR CREDITAS:
Don’t make us list the families we’re about to dismantle. Contact us.
CONTACT US
Telegram: @haroldthebaker
We (https://t.me/n_3_xl) hold high-priority target records from Creditas (creditas.com.br) complete with CPF (Brazilian taxpayer ID), full names, loan balances, and status.
Compromised Asset Inventory
85,000+ CPFs (→ 1M+ at the end of the dump)
170K+ company CNPJs
1,257+ mobile numbers
Validated credentials
Active OAuth tokens
Multiple accesses (GraphQL IDOR, SSRF, etc.)
Loss for Creditas: R$ 165–310 million
SAMPLE: https://privatebin.net/?85048f24dd86b8e6...MsueYTTtXr
Alongside 170,367 payroll company records (JSON), 135,947 reconciliation groups (pending payroll records reportedly used in the parent-account kill chain), 480 validated credentials (email:password:CPF) and 61 high-value debtors (BRL 40,000+) with mapped OTP-related information.
We know your weaknesses.. here’s how this ends badly for Creditas:
LGPD fines could cost Creditas millions in reais for non-compliance after this breach.
Borrowers could sue the company over exposed financial histories and active loans.
Security recovery would require budget in the millions to prevent further leaks.
A massive dump would crush customer trust, forcing high-risk clients to flee.
Reputation damage could bury Creditas for years.
FINAL WARNING FOR CREDITAS:
Don’t make us list the families we’re about to dismantle. Contact us.
CONTACT US
Telegram: @haroldthebaker