A newly reported security flaw in São Paulo’s Smart Sampa surveillance program exposed feeds from 17,000 cameras operated by businesses participating in the city initiative. According to UOL, the feeds could be accessed without a password or security confirmation for five days. The incident is the second large-scale exposure involving the program in less than a month: on October 20, the outlet reported that another 58,000 cameras were vulnerable.
The feeds were hosted by Monuv, a cloud storage provider for security cameras. They included views of streets near the homes of Supreme Federal Court Justice Alexandre de Moraes and former presidents Michel Temer and Fernando Henrique Cardoso, as well as entrances to São Paulo clubs including Hebraica and Sociedade Hípica Paulista. The links were taken offline on Friday, October 30, a day after UOL contacted the city government, Sentinelx, which is responsible for the program’s technology, and Monuv.
The latest vulnerability had a different cause from the earlier incident. A cybersecurity source told UOL that it stemmed from the source code of a website associated with Sentinelx. Files available online revealed service addresses used to look up information about participating businesses and cameras. This could expose business records, partner documents and complete camera-stream links that could be opened outside the platform. The flaw also allowed access to data relating to participating businesses that is protected under Brazil’s General Data Protection Law.
One issue identified was an insecure direct object reference, or IDOR. This type of vulnerability can let someone change identifiers in a website address to retrieve restricted records if the system does not verify their authorization. One unnamed cybersecurity specialist compared the platform to “Swiss cheese.” Researcher Davi Mikael Cezar, known as Penegui, said that concentrating access addresses under the same domain used to promote the product could make unauthorized access easier. He also told UOL that a compromise of that domain could put cameras at risk, depending on how the system was built.
Cezar said he found 15 Smart Sampa access credentials in leaked databases, with records from 2024, 2025 and 2026. He said the data had been collected by infostealer malware, which can steal information from infected devices, including passwords saved in browsers. The Folha de S.Paulo also reported that the vulnerabilities could provide access to equipment in other municipalities. One record involved a license-plate-reading camera in Campo Grande, accessed using a São Paulo login.
Sentinelx has used Smart Sampa as a reference for offering its technology to other cities. UOL identified company-related subdomains bearing the names of Guarulhos, Campinas, Joinville, Goiânia, Mairiporã and Catanduva. Sentinelx joined the Smart City consortium responsible for the program in December 2025, replacing Camerite. The consortium won the contract in 2023, valued at R$588 million over five years, with monthly payments of R$9.8 million. Its original members were CLD, Flama Serviços, PK9 and Camerite.
São Paulo’s Municipal Secretariat for Urban Security denied that the list of links had been publicly available. It said the file was a spreadsheet produced by municipal technology company PRODAM as part of a cybersecurity review that began on October 20 at the request of Mayor Ricardo Nunes. The city said the program remains operational, that it has found no evidence of external attacks, and that the spreadsheet did not include more than 20,000 cameras owned by the municipality. It described the file’s transmission to UOL as an illegal leak of confidential data and said it would take administrative and legal steps to investigate.
Sentinelx did not respond to UOL’s questions. Monuv said it maintains access controls, authentication and protections for data and video feeds, adding that access to cameras shared through Smart Sampa follows security specifications set by the program.
Sources: Olhar Digital.