Security vulnerability led to improper access to 58,000 Smart Sampa cameras

Brazil's UOL reported that credentials for São Paulo's Smart Sampa facial recognition surveillance system were exposed in a public code repository for 11 months, allowing improper access to 58,000 camera feeds. The leaked content included the login names and passwords of 181 authorized users, data on more than 6,000 security personnel, and instructions for reproducing the system on any computer or phone; UOL used AI prompts to build an interface, accessed and recorded feeds from multiple cameras, involving locations such as kindergartens and hospitals. The city government said this was an illegal data leak by one municipal guard (GCM) public official among more than 7,500 security personnel, denied that the platform had security weaknesses, and said the repository had been removed and independent passwords and two-factor authentication adopted. The report also noted that the city government does not possess the system's source code, AI models, or training data, which are controlled by Sentinelx, and that there is no independent audit; from November 2024 to May 2026, of 3,400 removals, 268 people were later released, accounting for 7.9%.