A fisherman in the outskirts of Manaus trawled up a plastic crate on 10 September and discovered more than 40 hard drives inside; forensic copies of those drives now point to a previously undisclosed agreement that routed biometric templates and benefit‑recipient records from a federal social ministry to a private company, GigaNet, for what was described internally as a “digital‑ID pilot.” The files name programmes, include matching logs for faces and fingerprints, and list linked phone numbers for millions of people.
The man who found the crate, David Venegas, 42, said he initially thought it was household waste. "I opened the lid because I needed rope, then I saw the drives and a plastic bag with printed labels — names, ID numbers. I knew they weren't mine," he said. Venegas carried the box to a local community hall and asked a volunteer with basic IT skills to take a look; that volunteer later contacted a university lab.
Kaj Mårtensson, a Swedish volunteer who has worked on community tech projects in Manaus and who received the first copy of the recovered files, said the data contained structured export folders labelled with ministry project names and database timestamps. "There are audit logs, filenames that map directly to benefit registers and to an electoral roll export — you don't see that in ordinary backups," Mårtensson told this newspaper after examining a write‑protected copy.
How the cache unraveled the pact
Forensics carried out at the Federal University of Amazonas (UFAM) identified file metadata and internal logs that point to nightly automated exports starting in April 2025 and running through June 2026. The exports include small, hashed face templates and fingerprint vectors linked to names, mobile numbers and municipal benefit profiles for roughly 28 million entries, according to the UFAM report seen by this paper.
If this is authenticated, it is mass transfer of uniquely identifying information without meaningful consent.
Helene Hoeger, privacy lawyer
Helene Hoeger, a Rio de Janeiro lawyer specialising in data protection law, said the material looks like more than a routine vendor backup. "The metadata shows destination IPs in GigaNet's cloud range and filenames that suggest processing for biometric matching. Under the LGPD, data controllers must ensure a legal basis and transparency — here there was none for those people," she said. Hoeger and two civil‑rights NGOs are preparing a court filing to force disclosure of the full contract and data maps.
Officials and company respond
GigaNet, a São Paulo firm listed on the local exchange, said yesterday that it conducted a contract with what the company described as the National Social Inclusion Ministry to pilot faster benefit enrolment through biometric authentication, and that all work was carried out under ministry direction and previously approved safeguards. A company email to staff, seen by this newspaper, instructed engineers to halt non‑essential transfers on 18 September after a ministry official raised concerns about archival procedures.
The ministry's communications team said the pilot aimed to reduce duplicate benefits and fraud and that archival copies of operational backups were normal for systems integration work. The ministry confirmed the contract number published on the government procurement site corresponds to a 2025 award but declined to provide a public list of datasets exchanged. The national data protection authority, ANPD, announced on 20 September it had opened an administrative proceeding and ordered a temporary freeze on certain transfers while it examines whether the processing complied with legal requirements.
Venegas said he fears for people whose personal details were inside the drives. "People here rely on their phones and small pensions. If their numbers and faces are out there, they can lose everything. I didn't want to be the person who threw it back into the river," he said. "I only wanted someone to check the files."
Senators from three different states have asked the ministry to hand over the full procurement file and a list of recipients whose information was exchanged; at least two opposition lawmakers said they will push for a parliamentary hearing next month. If ANPD finds violations of Brazil's data protection law, GigaNet and the ministry could face administrative fines and orders to delete improperly processed data, and several civil suits are expected to follow.
