Smart Sampa Leak Exposes 58,000 São Paulo Cameras

Access data for São Paulo’s Smart Sampa surveillance network sat exposed on the open internet for about 11 months, giving anyone who found it a route to live images from more than 58,000 cameras. A report published Tuesday, Oct. 20, 2026, detailed the breach, and the city’s prosecutors opened an inquiry that same day.

Smart Sampa reaches far beyond traffic corners. The network streams images from streets, schools, daycare centres and hospitals to a control centre run under Mayor Ricardo Nunes. Reporters reviewing the material found 181 logins and passwords for authorised users, data on more than 6,000 security agents, and step-by-step instructions for operating the system on computers and phones. That’s a lot of keys in one unlocked drawer.

The reporters went beyond reading the files. They built an interface to place camera feeds on a city map, then tested it. On Oct. 7, they saw images of themselves recorded by eight private cameras in the Campos Elíseos district of central São Paulo. They also accessed images from public sites, including health units and daycare centres. Some credentials reportedly bypassed the second login step entirely. Available tools let users search by name, CPF tax number, vehicle plate and incident record.

Who Bears the Risk

For people who pass those cameras, the danger is practical. Rafael Alcadipani, a public-security professor at the Fundação Getulio Vargas (FGV), told G1 that a kidnapper could learn about a target and a criminal could find out where police cars were. A specialist cited by UOL warned that some interfaces might let outsiders enter false facial-recognition or number-plate records. A child at a daycare or a patient in a health unit didn’t sign up for that exposure.

The network blends public and private eyes. It includes cameras owned by condominiums and shops, and Terra reported that some agreements retain recordings for up to 14 days. Residents who agreed to a private camera on their building didn’t necessarily agree to have their images flow into a municipal system searchable by name or plate.

The Accountability Gap

The city’s response blamed one person. In a written note, São Paulo said the leak resulted from an illegal act by one of more than 7,500 security agents, not a system failure. The city said it had identified and suspended the agent, who faced an investigation by the internal affairs office of the Guarda Civil Metropolitana (GCM), the municipal guard. It also said officials had taken the data repository offline and that it didn’t contain access passwords, contradicting the report’s account of 181 credentials. The city has since added unique passwords, two-factor login and SMS codes for new passwords.

The city also accused UOL of acting irresponsibly and misleading the public. It said the municipal audit court oversaw the programme and that it sent prosecutors a transparency report every six months. Those are real checks. Yet reporters also found that the city has no access to the facial-recognition source code or artificial-intelligence models and doesn’t independently audit the algorithms. Olhar Digital reported that, and it’s hard to square with the picture of tight public oversight the city describes.

The contractor carries the operational burden. Veja reported that Sentinelx runs the technology platform and joined the Smart City SP consortium, which holds a R$588 million (about US$117 million) contract with the city. Sentinelx replaced Camerite in the consortium through an amendment signed in January 2026. Veja said the contract makes the contractor responsible for system security and requires it to report abnormal events within 24 hours, with fines for breaches. The report found no statement from Sentinelx.

Official Response and the Inquiry

On Oct. 20, the São Paulo state prosecution service announced it would investigate. The case went to its public-property prosecution offices, and officials hadn’t named the prosecutor in charge. The Ministério Público is an independent state body with the power to examine public authorities. The inquiry doesn’t establish wrongdoing by the city or any individual, but it’s the kind of outside scrutiny that a system holding this much personal data should face as a matter of course.

The programme’s record is contested too. The city says Smart Sampa has helped capture 3,628 fugitives and locate 284 missing people. A Centre for Security and Citizenship Studies (CESeC) study, titled "Smart Sampa vigia, mas não protege," found no statistically significant drop in thefts, robberies or homicides between March 2024 and April 2025. The city disputes that finding. Olhar Digital reported that, between November 2024 and May 2026, authorities took 268 people to police stations after facial-recognition alerts and then released them. In 75 cases the identification was inconsistent, in 181 the warrants were outdated, and in 12 there were registration problems.

Much remains unknown. The report couldn’t establish where the data repository was hosted, who put it online, whether anyone besides UOL used the credentials, when the access data stopped working, or whether the agent acted intentionally. It’s also unclear whether prosecutors will examine the contractor alongside the agent, or whether the national data-protection authority will act.

Why This Matters: A surveillance system watching schools, hospitals and private homes is only as safe as its weakest password. This one was exposed for most of a year. The people most exposed have the least say in the arrangement: children at daycare, patients in clinics, and residents whose building cameras were folded into a city network they never chose. The city’s own record shows 268 people detained after facial-recognition alerts and then released, alongside a contested study questioning whether the system reduces crime at all. Those facts should drive how a city governs biometric tracking. Democratic oversight means independent audits of the algorithms, clear limits on who can search a face or a plate, and real consequences for the companies holding the keys. Without those guardrails, the promise of safety becomes a risk that falls hardest on the people it was meant to protect.