The Alleged Habib’s Breach Put 3.5 Million Brazilian Personal Records Online in 2021

HEROIC analysts surfaced a dataset in August 2021 linked to an alleged breach of Alleged Habib's, a Brazilian fast food chain. The database exposed 3,519,424 records containing email addresses, first and last names, phone numbers, birthdays, gender, and IP addresses. The data recieved significant circulation across Telegram channels and dark web marketplaces, with the true origin disputed but the risk to affected individuals very real.

How Names, Phones, and Birthdays From This Breach Enable Identity Fraud

Without passwords in the dataset, attackers shift to identity-based attacks. Full names, phone numbers, birthdays, gender, and IP addresses give threat actors enough detail to conduct SIM swap fraud, impersonate victims in support calls, and pass knowledge-based authentication checks. Brazilian users are partcularly targeted by fraud rings that specialize in CPF-based identity theft and telecom account takeover, making this data directly useful for financial crime.

What Was Exposed in the Alleged Habib's Breach

• Email Address
• First Name
• Last Name
• Phone Number
• Birthday
• Gender
• IP Address

Why Disputed Breaches Are Still a Real Threat

The uncertain attribution of this dataset does not reduce the risk to the 3.5 million people whose information is in it. Whether the data came directly from Alleged Habib's systems or was compiled from other sources, the personal details are accessable to anyone who trades in dark web data. Victims who beleive they are safe because the breach origin is disputed are still exposed to phishing, targeted scam calls, and account recovery attacks using their real personal details.

How a Database Breach Works

A database breach occurs when user records stored in a company's backend systems are extracted without authorization, typically through security vulnerabilities or insider access. In cases where attribution is disputed, the data is often compiled from multiple compromised sources into a single aggregated dump. These composite datasets are distributed across dark web forums and messaging apps, where they are bought, sold, and repackaged into targeted attack campaigns.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records, including the Alleged Habib's dataset, to tell you whether your email address appears in known breach collections. Run your free scan at HEROIC.com and find out if your personal information is already in circulation on the dark web.