Capesesp Listed by akira Ransomware Group

On January 10, 2025, the Brazilian pension fund Capesesp appeared on the leak site of the Akira ransomware group. The organization, formally known as the National Health Foundation Employee Pension and Assistance Fund, had more than 90 GB of internal files exfiltrated. Public reporting indicates the data includes HR documents, employee and customer contact numbers and email addresses, INSS records, personal identity cards, confidential corporate files, employee medical documents, and birth certificates.

Reported Details of the Incident

Available reporting describes Capesesp as a closed supplementary pension entity sponsored by Brazil’s National Health Foundation (FUNASA). The Akira group claims to have stolen the files during a ransomware attack and is now offering them for download on its leak portal. No exact number of individuals affected has been publicly confirmed, but the volume and nature of the documents suggest thousands of current and former employees, pension recipients, and their families could be exposed. The group has not yet set a specific public extortion deadline in the posted notice, though Akira’s standard practice involves giving victims a short window before full data publication.

Why This Matters for You and Your Family

When a health-related pension fund loses control of personal records, the consequences reach ordinary families quickly. Medical documents, birth certificates, and identity cards can be used to file fraudulent claims, open accounts in your name, or impersonate you with government agencies. Email addresses and phone numbers harvested here often feed the first wave of phishing and smishing attacks aimed at your household. If you or a family member has ever worked with FUNASA, received benefits through Capesesp, or had records stored in its systems, your information may now be circulating among criminals.

The Doxxing and Identity-Chain Risks

Leaked HR and medical files rarely stay isolated. Attackers combine names, dates of birth, national ID numbers, and contact details with information from earlier breaches to build detailed profiles. A single exposed email can link gaming accounts, social-media handles, and family addresses, turning one breach into a chain of identity theft and doxxing attempts. Credential leaks like this one frequently cascade into account takeovers on gaming platforms, where children’s accounts become entry points for further harassment or extortion. Public reporting indicates these identity chains can persist for years once the data reaches underground forums.

Akira Ransomware Group’s Track Record

Public reporting attributes the attack to the Akira ransomware group, which first emerged in 2023. The group has targeted organizations across healthcare, education, manufacturing, and government sectors. Notable prior victims include municipalities, manufacturing firms, and healthcare providers in North America, Europe, and Latin America. Akira’s typical playbook involves initial access through compromised credentials or remote desktop vulnerabilities, followed by exfiltration of sensitive files before encryption. The group then demands ransom for both decryption and non-disclosure; when unpaid, it publishes samples and offers the full dataset on its leak site. Reporting notes that Akira often focuses on organizations holding personal or regulated data that carries high resale value.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by specialists.
• Rotate any password you used for Capesesp-related services anywhere it has been reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts vulnerable to credential-based takeovers.
• Let remediation specialists manage takedown requests across data brokers and leak sites on your behalf while you focus on securing daily accounts.

The Capesesp breach is a reminder that data once held by pension and health organizations can surface without warning and affect daily life for years. Taking concrete steps now limits how far criminals can travel down the identity chain created by this 90 GB leak. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of what criminals already hold.