Descomplica descomplica.com.br Descomplica data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In March 2021, Brazilian education company Descomplica was breached. Have I Been Pwned lists 4,845,378 accounts with email addresses, names, partial credit card data, purchase histories and password hashes. The data was later posted online.
View all 13,118 breaches- Breach date
- 14 Mar 2021
- Affected
- 4,845,378
- Data exposed
- Email addresses, Names, Partial credit card data, Passwords, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Descomplica is a Brazilian online education company. In March 2021 it suffered a cyberattack, and the stolen data was later posted online. The company published an FAQ about the attack of 14 March, and told Brazilian tech press that the incident affected different data for different groups of students.
Have I Been Pwned (HIBP) lists 4,845,378 accounts, covering almost 5 million email addresses.
Sources checked: haveibeenpwned.com, tecnoblog.net
Last verified against the official page:
What was exposed
The data included email addresses, names, passwords, purchase histories and partial credit card data: the first 6 and last 4 digits plus the expiry date. Descomplica said passwords were leaked in hashed form and that the partial card numbers aren't enough on their own to make a purchase, since the full number and the security code were not included.
What it lets criminals do
Partial card details aren't a way to spend your money directly, but they help scammers sound legitimate when they pretend to be your bank or the school. Purchase histories tell them which courses you bought. Cracked passwords get tried on other accounts. The email and name combination is enough for personal phishing, in Portuguese or English.
What to do
Start with the password, then tell your card issuer if you want extra caution.
What to do if you were in it
- 1
Change your Descomplica password, and any you reused it on
Pick a new, unique password on the affected site, then change it everywhere you used the same or a similar one. A password manager makes unique passwords easy to keep.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your email, banking and shopping accounts. It stops most account takeovers even when a password is already out there.
- 3
Ask your card issuer about replacing the card
Only the first 6 and last 4 digits and the expiry date leaked, so this isn't urgent. If you want to be safe, ask for a new number and watch your statements.
- 4
Expect phishing that mentions the breach
With your name, email and purchase history out, scammers can write emails and texts that look personal. Don't click links in unexpected messages. Go to the company's site yourself.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email and phone number, and Serus keeps monitoring and alerts you when your details turn up in a new leak.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Descomplica breach?
If you were a Descomplica student or customer in early 2021, you may be. Look up your email on Have I Been Pwned or run a free Serus scan.
What was exposed?
Email addresses, names, partial credit card data, purchase histories and password hashes, per HIBP.
Can someone use my card with the leaked details?
Not on their own. Descomplica said the full number and security code weren't included. Still watch your statements.
Should I change my password?
Yes, and on any site where you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
