> just tax id, which in Brazil nowadays doesn't mean much
Fraudsters can go as far as opening bank accounts with that information, take loans an disappear, I don't know what you mean with "doesn't mean much". Not every brazilian is in "BC Protege", which would prevent this.
Also the fact that it has been leaked before does not diminish what has happened here, maybe the new bad actors did not have access to previous information.
But who would be affected, the institutions or the actual customers whose information was leaked? Any fraudulent activity based on the leaked information cannot be directly blamed on the customers themselves and should be a problem the institutions to be stuck with and solve.
You're not looking at the full picture. Of course customers ultimately won't be responsible. But they might have to spend weeks/months/years fighting multiple systems for those accounts/charges/debts to be removed from their names. And just when you think it's solved, there's another one! Anyone who's been through this will tell you that it's very stressful and time consuming, unfortunately.
People are seriously underestimating the impact of these leaks.
I've had government websites authenticate me by CPF and birth date on my first login. These government people made this and thought there was nothing wrong with it, it's literally in production right now.
Fraudsters can go as far as opening bank accounts with that information, take loans an disappear, I don't know what you mean with "doesn't mean much". Not every brazilian is in "BC Protege", which would prevent this.
Also the fact that it has been leaked before does not diminish what has happened here, maybe the new bad actors did not have access to previous information.