Municipal Data Breaches: The Smart Sampa Warning

Estimated reading time: 4 to 5 minutes. Research updated on October 29, 2026.

In my article about the Feira de Santana data breach, I examined the disclosure of health information in the municipal Official Gazette and offered suggestions for making compliance with Brazil's General Personal Data Protection Law (LGPD) part of everyday work. The Smart Sampa case, involving São Paulo's municipal government, adds another question: how can we ensure that information held in a surveillance system is accessed only by authorized users?

What has been reported about Smart Sampa

On October 20, 2026, UOL reported that a public repository had exposed 181 username-and-password combinations and information about more than 6,000 security officers for approximately eleven months. The outlet says it gained unauthorized access to the platform, which was connected to more than 58,000 cameras, including cameras at education and healthcare facilities. These figures describe the scope reported in the investigation; they do not establish that all recordings were copied. 1

The municipal government acknowledged an unlawful disclosure attributed to an employee and said the employee had been suspended and was under investigation. However, it disputed the existence of a weakness in the platform and of passwords in the repository. It also announced the removal of the material and stronger authentication. These are the parties' positions, still subject to investigation. 1

In a report published on October 23, Mobile Time said that Brazil's National Data Protection Agency (ANPD) had requested clarification within five business days; the municipal government said it would respond within that period. On October 28, Agência Brasil reported that the National Human Rights Council had called for the program's suspension. That request does not mean a suspension has taken effect or that there has been a final ruling establishing liability. 2 3

An earlier case: permissions on an education folder

Another episode was confirmed by the municipal government itself. Between August 9 and 12, 2025, a Google Drive permissions error made a directory belonging to the Itaquera Regional Education Directorate accessible. The municipal statement estimated 207,328 potentially affected data subjects, including students, guardians, and staff. In its August 19 disclosure, it said there was no evidence of mass downloading. 4

This is an earlier case, included for its operational lesson: reviewing sharing permissions needs to be part of the work of anyone managing documents containing personal data.

My recommendations for putting data protection into practice

I return to the recommendations from the Feira de Santana article, applying them to everyday work in municipal governments and businesses:

1. Map data and responsibilities. Identify systems, spreadsheets, folders, suppliers, purposes, and retention periods. Someone needs to be accountable for decisions about each processing operation.

2. Review access in practice. Use individual accounts, multifactor authentication, and permissions limited to each person's role. Revoke access when people leave or change duties, and check for public sharing.

3. Review before publishing or sharing. Keep the complete internal version of a document separate from its public version. Check fields, attachments, and permissions before granting external access.

4. Ask suppliers for evidence. Define responsibilities in contracts and examine access logs, security tests, fixes, and recovery capabilities. Oversight needs to cover what actually works in day-to-day operations.

5. Prepare the response and track improvements. Define who contains an exposure, preserves evidence, assesses impacts, and manages notifications. Train the team and maintain a plan with owners, deadlines, and checks on completed work.

These measures are consistent with the ANPD's security guidance and should be adapted to each organization's size and risks. 5 For higher-risk operations, I also recommend considering a Personal Data Protection Impact Assessment (RIPD), according to the circumstances and applicable requirements. 6

For processing subject to the LGPD, incidents capable of causing significant risk or harm must be reported to the ANPD and affected data subjects. The general deadline is three business days from becoming aware that the incident affected personal data. 7

For Smart Sampa, the legal assessment requires examining the purposes of each processing activity: Article 4 provides an exception for activities carried out exclusively for public security, while preserving general principles, data subjects' rights, and the ANPD's statutory powers. The legal conclusions in the Feira de Santana case therefore cannot automatically be transferred to this program. 8

How I can help

I can help businesses organize LGPD compliance, connecting management, processes, and technology: assessment, data inventories, access reviews, controls, and incident response, working with legal counsel on specific legal questions.

My approach starts with verifiable deliverables: knowing where the data are, addressing priority risks, and defining who is responsible for each step. This everyday care needs to accompany the digitization of services.

Sources

1. UOL — Smart Sampa investigation and the municipal government's response, October 20, 2026.
2. Mobile Time — ANPD request for clarification, October 23, 2026.
3. Agência Brasil — CNDH calls for Smart Sampa's suspension, October 28, 2026.
4. São Paulo municipal government — Municipal Education Department statement, August 19, 2025.
5. ANPD — Security measures checklist.
6. ANPD — Guidance on the RIPD.
7. ANPD — Guidance on incident notification.
8. Chamber of Deputies — LGPD, particularly Article 4 and its paragraphs.