Over 16 million COVID-19 patients in Brazil, including President Bolsonaro, had their info leaked on a spreadsheet uploaded to GitHub by a hospital employee
Among those affected by the leak are Brazil President Jair Bolsonaro, seven ministers, and 17 provincial governors. Tweets: @johnlilic , @arielbogle , @fascinatorfun , @campuscodi , and @1br0wn Tweets: John Lilic / @johnlilic : here's what happens when gov't builds software - 85% of rona tracking apps leak data - vast majority of medical apps (91%) have mishandled and/or weak encryption - 71% of tested medical apps have at least one high level security vulnerability https://www.zdnet.com/... Ariel Bogle / @arielbogle : Any cybersecurity conference I've been to, I've made a point of going to sessions about health facilities and data. Good people doing good work, but honestly, I've always left *slightly* terrified by the scale of the problem. https://twitter.com/... Fionna O'Leary / @fascinatorfun : Gulp. “The leak came to light after a GitHub user spotted the spreadsheet containing the passwords on the personal GitHub account of an employee of the Albert Einstein Hospital in the city of Sao Paolo” https://twitter.com/... Catalin Cimpanu / @campuscodi : NEW: The personal and medical data of 16 million Brazilian COVID-19 patients was exposed online Leak occurred after a hospital employee uploaded a spreadsheet with passwords and access keys to government databases on his GitHub profile. https://www.zdnet.com/... https://twitter.com/... @1br0wn : “data for Brazilians across all 27 states was included in the two databases, including high profile figures like the country's president Jair Bolsonaro, the president's family, seven government ministers, and the governors of 17 Brazilian states.” https://www.zdnet.com/...
Context & Ripple Effects
The leak is a single spreadsheet uploaded by one employee at São Paulo's Albert Einstein Hospital, but its contents make it a national-security-grade incident: personal and medical records for over 16 million COVID-19 patients, including President Jair Bolsonaro, seven ministers, and 17 governors — plus passwords and access keys into government databases. It lands on top of a fraught year for Brazilian pandemic data: after the government's July data blackout of official COVID-19 figures, volunteer developers had stepped in to keep the information public, so health data was already flowing through informal channels.
First-order effects
- Every individual named in the spreadsheet — from Bolsonaro down to ordinary patients — has medical status and identity data exposed, and the bundled database credentials mean attackers could pivot from viewing the leak to directly accessing government health systems until those keys are rotated.
- GitHub and the hospital face immediate cleanup pressure: removing the file does not undo exposure, since repositories are cloned and scraped within hours of upload.
Second-order effects
- The incident set the template for a pattern rather than a one-off: a week later, passwords left in source code exposed data on 243 million Brazilians for at least six months (the health ministry's own credential leak), forcing Brazilian authorities to treat hardcoded secrets as a systemic failure, not an employee mistake.
- A year on, the same ministry's fragile data estate was hit by ransomware that took down millions of vaccination certificates and 50TB of data — adversaries demonstrably targeting the systems whose access paths had already leaked twice.
Third-order effects
- If the pattern holds, pandemic-era health digitization becomes a standing national-security surface: credential hygiene inside code repositories and contractor access become matters of state audit, not IT policy, and pressure builds for formal regulation of who can move patient datasets between hospital and government systems.
- The volunteer-developer workaround born of the July blackout shows the alternative governance vacuum — when official channels fail or leak, sensitive data migrates to informal pipelines with even weaker controls.
The trend: Brazil's rushed digitization of pandemic health data is repeatedly outrunning basic credential and access controls, turning COVID-19 databases into a recurring target for leaks, scrapers, and ransomware crews alike.