Data Breach Exposes 468k Records from Portugal's National Postal Service

Severity: Medium (Score: 54.9)

Sources: haveibeenpwned.com

Published: 2026-05-21 · Updated: 2026-05-21

Keywords: data, haveibeenpwned, january, parody, site, windows93, suffered

Summary

In April 2026, data from CTT, Portugal's national postal service, was leaked on a public hacking forum. The breach involved 468,000 unique email addresses, names, phone numbers, and parcel tracking numbers, which could be exploited to access tracking history. This incident raises significant privacy concerns for affected individuals. Users are advised to change passwords for accounts linked to the exposed emails and implement two-factor authentication where possible. The breach highlights ongoing vulnerabilities in public service data security. No specific attack vector or method was detailed in the report. The current status of the investigation into the breach remains unclear. Security experts recommend using password managers to enhance account security. Key Points: • CTT data breach exposed 468,000 records including personal information. • Users should change passwords and enable 2FA for affected accounts. • The breach was posted on a public hacking forum, raising privacy concerns.

Detailed Analysis

**Impact** Approximately 468,000 unique email addresses from CTT, Portugal's national postal service, were exposed in April 2026. The leaked data includes names, phone numbers, and parcel tracking numbers, potentially allowing unauthorized access to parcel tracking histories. The breach affects customers of the postal service in Portugal and may lead to privacy violations and targeted phishing attacks. No information on financial or operational disruptions was provided. **Technical Details** The data was posted on a public hacking forum, indicating unauthorized data exfiltration likely through a compromised internal system or insider threat. No specific attack vectors, malware, CVEs, or infrastructure details were disclosed. The breach appears to be in the data exfiltration and dissemination stages of the kill chain. No IOCs were provided in the available sources. **Recommended Response** Users should immediately change passwords associated with the breach and enable two-factor authentication where available. Organizations should monitor for unusual access patterns to parcel tracking systems and review access controls to sensitive customer data. Deploying alerts for data exfiltration attempts and blocking known public forum URLs where data is posted is advised. No specific patches or technical mitigations were identified from the sources.

Source articles (2)

• HaveIBeenPwned — haveibeenpwned.com · 2026-05-21
  In January 2021, the parody site Windows93 suffered a data breach of the Myspace93 sub-site after a beta application was exploited to download server files. The compromised data was later leaked in Ju…
• HaveIBeenPwned — haveibeenpwned.com · 2026-05-19
  In April 2026, data allegedly obtained from CTT, Portugal's national postal service, was posted to a public hacking forum . The data included 468k unique email addresses along with names, phone number…

Timeline

• 2026-04-01 — Data from CTT leaked: Data from Portugal's national postal service was posted on a public hacking forum, exposing sensitive user information.
• 2026-05-19 — Breach reported by HaveIBeenPwned: The breach was disclosed, detailing the scope and type of data compromised.
• 2026-05-21 — Ongoing security recommendations issued: Users are urged to change passwords and enhance security with 2FA and password managers.

Related entities

• Data Breach (Attack Type)
• Myspace93 (Company)
• Windows93 (Company)
• CWE-200 - Exposure of Sensitive Information (Cwe)
• T1567 - Exfiltration Over Web Service (Mitre Attack)