Poços de Caldas suspends parking app after customer data leak
The Prefecture of Poços de Caldas, Minas Gerais, has temporarily suspended the EXP Parking application, which manages the city's rotational parking system. This decision follows a significant data leak affecting customers, leading to the cancellation of parking irregularity notifications issued since July 2nd. The municipal government is demanding that EXP Parking guarantee the integrity of payment methods and has requested the implementation of secure Pix payment options within the app. The data breach, which included customer names, CPF numbers, and credit card details, was reported to the prefecture on the evening of July 7th by platform users. In response, the Procon initiated an administrative procedure on July 8th to investigate the incident, ensure compliance with data protection laws, and implement protective measures for users. The Municipal Department of Transport and Transit also formally notified the concessionaire, demanding information and details on corrective actions taken. After receiving an unsatisfactory partial response, the Prefecture issued a supplementary notification on Friday, the 10th, with further questions and a 24-hour deadline for a response. The prefecture has also halted new irregularity notices until the company proves platform security and reimburses users who paid for notices issued during the compromised period. EXP Parking confirmed the cyberattack, stating it has launched an investigation, but has not yet responded to the Prefecture's specific demands. The company noted that contact information like phone numbers and emails were not compromised. As a preventative measure, EXP Parking has temporarily suspended credit card payments and is working with specialized firms and the National Data Protection Agency (ANPD). Procon advises affected users to contact their credit card providers, monitor financial statements, be wary of phishing attempts, and consider filing a police report if fraud is suspected. EXP Parking is expected to reimburse any costs associated with new card issuances.
The data leak from the EXP Parking application in Poços de Caldas highlights critical vulnerabilities in municipal service technology and data security practices. This incident underscores the imperative for robust cybersecurity measures, especially when sensitive financial and personal identification data are handled. The prefecture's swift action, including suspension and demands for enhanced security and payment options like Pix, reflects a growing awareness of digital risks and consumer protection needs. Moving forward, regulatory bodies and municipal governments must establish clearer standards for third-party vendors managing public services, ensuring comprehensive data protection compliance and transparent incident response protocols. The long-term implications involve building public trust in digital civic services, which requires consistent demonstration of security, reliability, and accountability from both service providers and the authorities overseeing them.
AI-generated to prompt reflection — not editorial opinion, not advice, not a statement of fact. How this works.