The country''s most prestigious hospital had names, CPFs, prescriptions and exam results extracted from its patient database. The federal police executed temporary arrest and search warrants in Joinville. And the most revealing data point of the case is not the arrest: it is what the hospital cannot say.
The facts
Per G1: Einstein detected suspected unauthorized access on August 4. The federal police launched the operation on October 7, almost two months later, with temporary arrest and search and seizure, and the suspects demanded payment after the extraction. The ANPD was notified and affected patients are being notified by email, one by one.
What was taken: registration records with name, CPF and/or date of birth, and health information such as medical prescriptions and exam results. That places the case in the heaviest LGPD category, sensitive data, and one step before the same ANPD that already opened a sanction process for another healthcare breach, ISAC''s, with half a million patients.
The detail nobody is exploring
About how many patients were affected, the hospital gave no number. The justification is that the data is stored in fragmented fashion across decentralized bases, and that a relevant portion corresponds to loose documents, many without identification.
Translated: the institution cannot size its own loss because it does not map where its data lives.
The technical finding of the case
For anyone operating infrastructure, this is the technical finding of the case: a breach is an event, and not knowing the breach perimeter is architecture. Without an inventory there is no notification scope, no damage measurement, and no way to prove to the regulator what left and what did not.
The response process worked: ANPD notification, federal police engagement, individual patient notices and independent forensics. What failed came earlier: the base that cannot count the loss.
It is the same thread the ANPD''s enforcement map and the 279 million CPFs case had already pulled: whoever cannot measure the loss cannot defend it before the regulator either.
Conclusion
The question left is not about Einstein. It is about the sector: if the country''s most sophisticated institution does not know the size of its own loss, how many Brazilian healthcare institutions do? The data inventory is what turns a breach from an undefined event into an incident with scope, and scope is what separates response from improvisation.