Smart Sampa Leak Exposes 58,000 São Paulo Cameras

Access data for São Paulo’s Smart Sampa surveillance network sat exposed on the open internet for about 11 months, opening a route to live images from more than 58,000 cameras, according to a report published on Tuesday, Oct. 20, 2026. City hall confirmed a leak but denied any system flaw. It blamed one security agent, while state prosecutors opened an inquiry that same day.

Smart Sampa is a camera and facial-recognition network in Brazil’s largest city, run under Mayor Ricardo Nunes. It streams images from streets, schools, daycare centres and hospitals to a control centre. The leaked material reportedly included 181 logins and passwords for authorised users, data on more than 6,000 security agents, and instructions for operating the system on computers and phones. That’s a lot of keys sitting in one unlocked drawer.

What Reporters Found

Using the material, reporters built an interface that displayed camera images on a city map. In a test on Oct. 7, they saw themselves captured by eight private cameras in the Campos Elíseos district of central São Paulo. They also accessed feeds from public sites, including health units and daycare centres. Some credentials reportedly opened the technology platform without a second login step. Available tools allowed searches by name, CPF tax number, vehicle plate and incident record.

Rafael Alcadipani, a public-security professor at the Fundação Getulio Vargas (FGV), told G1 that a kidnapper could learn about a target and a criminal could find out where police cars were. A specialist cited by UOL said some interfaces might let outsiders enter false facial-recognition or number-plate records. Those warnings aren’t abstract. They describe the very kind of damage a system like this is meant to prevent.

The City’s Response

In a written note, the city said one of more than 7,500 security agents had leaked the material illegally, and insisted the system had not failed. Officials identified and suspended the agent, while the internal affairs office of the Guarda Civil Metropolitana (GCM), the municipal guard, began an investigation. The city said it took the data repository offline and that the repository did not contain access passwords, contradicting the report’s account of 181 credentials.

Officials said they had since added unique passwords, two-factor login and SMS codes for creating new passwords. The city also accused UOL of acting irresponsibly and misleading the public by calling the incident a security failure. It maintained that no one had ever improperly used the platform and that the municipal audit court oversees the programme. The city says it sends prosecutors a transparency report every six months.

The city added that cameras in public buildings cover common areas only, not consulting rooms or care areas. Capturing an image, it said, doesn’t mean the system registered or identified a person.

Who Holds the Keys

Sentinelx runs Smart Sampa’s technology platform and joined the Smart City SP consortium, which holds a R$588 million (about US$117 million) contract with the city, Veja reported. Sentinelx replaced Camerite in the consortium through an amendment signed in January 2026. Veja said the contract makes the contractor responsible for system security and requires it to report abnormal events within 24 hours, with fines for breaches. The report found no statement from Sentinelx.

Olhar Digital reported that the city has no access to the facial-recognition source code or artificial-intelligence models and doesn’t independently audit the algorithms. That’s a striking gap for a programme of this size. G1 put the running cost at about R$10 million a month (about US$2 million), meaning taxpayers are paying steeply for a system city officials can’t fully inspect.

The Results Debate

São Paulo launched Smart Sampa in 2024, and its control centre opened that July. The network operates around the clock, drawing images from public and private cameras. Artificial intelligence compares faces with official databases of wanted and missing people and flags stolen or cloned vehicles. The city says the programme has helped capture 3,628 fugitives and locate 284 missing people.

A Centre for Security and Citizenship Studies (CESeC) study titled “Smart Sampa vigia, mas não protege” found no statistically significant drop in thefts, robberies or homicides between March 2024 and April 2025. The city disputes that finding. Olhar Digital also reported that facial-recognition alerts led to 268 people being taken to police stations between November 2024 and May 2026, then released. In 75 cases the identification was inconsistent, in 181 the warrants were outdated, and in 12 there were registration problems.

Election Stakes

The leak became a campaign issue five days before the Oct. 25 runoff between Flávio Bolsonaro of the Liberal Party (PL) and President Luiz Inácio Lula da Silva of the Workers’ Party (PT). Flávio Bolsonaro’s government plan promises a national facial-recognition system inspired by Smart Sampa and the state government’s “Muralha Paulista,” with more than 1 million new cameras, according to plan text cited by Terra. But Mayor Ricardo Nunes of the Brazilian Democratic Movement (MDB), not the federal government, runs the programme. The report said the Bolsonaro campaign hadn’t responded to questions about the leak.

The network combines public cameras with private ones, including cameras belonging to condominiums and shops. Terra reported that some agreements keep recordings for up to 14 days. Several basic questions remain unanswered. Officials haven’t said where the data repository was hosted, who put it online, whether anyone besides UOL used the credentials, when the access data stopped working, or whether the agent acted intentionally. It’s also unclear whether prosecutors will examine the contractor as well as the agent, or whether the national data-protection authority will act.

Why This Matters: A network of more than 58,000 cameras, tied to public spending of roughly R$10 million a month, was reachable from the open internet for most of a year. The city’s own account acknowledges that credentials for 181 users existed in a leaked repository, even as officials dispute how many were live. Sentinelx, the contractor, has contractual security duties and a 24-hour reporting obligation, yet the public hasn’t heard from the company. The city can’t audit the facial-recognition algorithms it relies on, and an independent study disputes the crime-reduction record. From a center-right standpoint, these facts point to a familiar problem with large government programmes: sweeping authority and substantial spending, with accountability spread thinly across a municipality, a private consortium and an agent suspended only after reporters came calling. Whether the state prosecutors’ inquiry produces answers about the contractor, not just the individual, will determine if the leak becomes a lesson in oversight or simply a one-officer story. For residents walking past those cameras, the question is less abstract than the campaign rhetoric suggests.