The "forgot password" flow prompts me for the exact same information, by the way. Only reason it's secure is it sends the usual password reset email to my actual email. Were it not for that, anyone on my accountant's office would have the ability to take over my account at any time.

This particular breach isn't all that serious, but there have already been breaches so extensive that entire databases worth of financial and marketing information on every Brazilian citizen have made it to darknet sites and are already up for sale.

https://cyberbrics.info/the-largest-personal-data-leakage-in...

> names, unique tax identifiers, facial images, addresses, phone numbers, email, credit score, salary and more

> 223 million Brazilians

> 104 million vehicle records

> literally all types of personal data you may think of, plus many you are not really thinking about

> ID number, marital status, and list of all first-degree relatives (parents, son or daughter, siblings, spouse), complete home address (including latitude and longitude), credit score, voter registration number, profession, and even link to LinkedIn profile

> level of education, salary, income, purchasing power

Authenticating Brazilians via random bits of personal information like date of birth in 2026 is just total insanity.