in Barcelona
3 to 5 Nov 2026
Restricted data from Smart Sampa, the video surveillance programme of the Prefeitura de São Paulo, stayed in a public online repository for about 11 months before the news portal UOL reported the exposure on 20 October 2026, with the material including 181 active access credentials, registration data on more than 6,000 security agents and technical instructions for rebuilding the platform interface. The programme covers more than 58,000 cameras in a city of 11,451,999 inhabitants in the state of São Paulo, Brazil, and city hall has attributed the exposure to one accredited agent rather than to a failure of the platform.
The contract under which the Consórcio Smart City SP deploys and operates the technology allows a fine of up to €10.42 million for a breach of information security, according to a Folha de S.Paulo report published on 21 October 2026. The sum equals 10% of a €104.20 million contract that city hall signed on 7 August 2023, and amounts in this article are converted from Brazilian reais at the European Central Bank reference rate of 5.6432 reais per euro on 21 October 2026.
What the Exposed Repository Contained
The exposure was relayed by several Brazilian outlets after the UOL report. According to those reports, the repository held 181 active access credentials, registration data on more than 6,000 security agents, and technical instructions for rebuilding the platform interface on computers and phones.
UOL said its journalists validated the material on 7 October 2026 and viewed live footage from eight private partner cameras in the Campos Elíseos district of central São Paulo. The outlet also reported that some credentials worked without two-factor authentication, which the city has since made mandatory.
City Hall Points to One Agent, Not the Platform
The city says the platform’s security mechanisms did not fail and attributes the exposure to an illegal act by one of more than 7,500 accredited agents of the Guarda Civil Metropolitana. It reports that the employee has been identified, removed from duty and referred to the force’s internal affairs unit, and that no misuse of the platform was recorded.
Mayor Ricardo Nunes (MDB) said his administration already knew of the exposure and was monitoring it to detect improper access, according to Folha. The Ministério Público de São Paulo has opened a preliminary file, a notícia de fato, which is not yet a formal civil inquiry, and the consortium did not respond to the newspaper’s requests for comment.
A Penalty Clause That Ranks Security Breaches at the Top of the Scale
Folha reports that the contract classifies a breach of the information security policy as its most serious infraction, graded 10, and that the fine applies only if an investigation finds the consortium responsible. The companies keep the right to a defence, and the final amount depends on the contract base used in the calculation.
Lawyer Luís Felipe Vicente Pires told the newspaper that the sanctions are set per month of non-compliance, so the exposure could be about eleven times the headline figure if each month of the exposure were counted. He also described the contract as poorly drafted and expects the matter to reach the courts, according to Folha.
The Consortium Behind the Platform and Its Changing Membership
The Consórcio Smart City SP was formed at the 2023 tender by CLD Construtora, Laços Detetores e Eletrônica Ltda. with 50%, Flama Serviços Ltda. with 34%, Camerite Sistemas S.A. with 15% and PK9 Tecnologia e Serviços with 1%, according to a 2023 Intercept Brasil analysis. The same report states that the consortium placed third among 12 bidders and won after L8 Group S.A., which had bid lower, was disqualified.
Folha now lists CLD, PK9, Flama and Sentinelx Tecnologia as the members. UOL reported that Sentinelx, which controls the facial recognition source code, models and training data, entered through a December 2025 amendment replacing Camerite and was created about a month after the contract was signed.
Contract Scale: From 20,000 Tendered Cameras to 58,000
The city’s August 2023 announcement described 20,000 cameras with facial biometrics, a ceiling of 40,000 including privately owned units, a payment of €1.74 million per month and an 18-month installation period. The Intercept Brasil report places the term at 60 months, which matches the €104.20 million total.
The network now covers more than 58,000 cameras according to the reports on the exposure, and the city added a monitoring helicopter in June 2026 at about €354,000 per month, as ABC Agora reported. The city’s public dashboard credits the programme with 3,629 fugitives captured, 285 missing persons located and more than 6,800 arrests in flagrante.
Performance Evidence Already in the Public Record
A study by the Centro de Estudos de Segurança e Cidadania covering March 2024 to April 2025 found no statistically significant fall in robbery, theft or homicide rates against other São Paulo municipalities, and the city disputes its choice of comparison cities. UOL reported 268 people taken to police stations after facial recognition alerts between November 2024 and May 2026, of whom 75 were linked to identification inconsistencies, and a match threshold raised from 90% to 92% in February 2025.
The city cites oversight by the Tribunal de Contas do Município, audits and semiannual reports to the Ministério Público. The model has also been cited by national politicians, including Flávio Bolsonaro (PL), who has proposed a national camera network based on Smart Sampa.
What Will Set the Size of Any Penalty
The Ministério Público decision on whether to convert the preliminary file into a civil inquiry is the next formal step, and the contract allows a fine only after an investigation attributes responsibility to the consortium. The amount will then turn on whether the exposure is traced to the platform’s access controls or to one agent’s conduct, and on whether the monthly sanction clause is applied once or across the roughly 11 months the repository stayed online.
