Security Incident at XP

XP reported becoming aware, on March 22, 2025, of unauthorized access to a database hosted by one of its external vendors. The company stated it immediately blocked the access upon detecting the incident and assured that no internal XP systems were compromised.

According to the statement, customer accounts and investments remain secure, and no financial transactions were carried out as a result of the unauthorized access. XP apps and websites can continue to be used normally, and there is no need to change passwords. Sensitive information such as passwords, electronic signatures, biometrics, Social Security numbers (CPF), or identity documents were not accessed.

The internal investigation found that the exposed data includes registration information such as name, phone number, email, date of birth, zip code, marital status, gender, job title, and nationality. Binary data indicating whether customers hold certain products — such as credit cards, insurance, and pension plans (yes/no) — was also accessed, with no further detail. XP account information as of March, including account number, balance, position, advisor name, and credit limit, was also exposed.

XP stated it notified the relevant authorities and launched a detailed investigation (a fact confirmed by Brazil's National Data Protection Authority — ANPD). The company warns customers to be wary of phone calls made in XP's name requesting transaction confirmations or security data, reinforcing that it never asks for passwords, tokens, or codes via phone, SMS, or email. If in doubt, customers should use official support channels.

According to a report by the legal news portal Jota, the first lawsuit against the institution has already been filed. In support of the claim, the plaintiff's attorneys indicated that the leaked data was found on the dark web. At the same time, the number of fraudulent calls received by customers increased considerably following the reported incident.

This post was summarized from its original version using ChatGPT version 4o, with human review.

Source: XP