Smart Sampa Leak Exposes 58,000 Cameras

BRAZIL · SURVEILLANCE

The Smart Sampa leak gave outsiders a way into live images from more than 58,000 cameras in São Paulo, Brazil’s largest city, according to a UOL investigation published on Tuesday 20 October 2026. The city hall confirmed a leak the same day but denies any flaw in the system and blames one security agent.

For US readers the case is a warning about city-wide facial recognition, a technology that many American cities also debate, and about a Brazilian security model now in a presidential race. São Paulo is also a base for many US companies and a frequent stop for American travellers.

Brazil Election Data Room

Runoff poll average: Flávio Bolsonaro 51.1%, Lula 48.9%

26 national polls from 14 pollsters since 4 October, updated hourly. Every poll, free to download.

The row lands five days before the runoff on Sunday 25 October 2026, because conservative candidate Flávio Bolsonaro of the Liberal Party (PL) has promised a national system inspired by the programme. State prosecutors announced an inquiry on the day the story broke, and our earlier report on the city guard is here: São Paulo Moves to Turn Its City Guard Into a Police Force.

What UOL Found in the Smart Sampa Leak

UOL said sensitive data from the system stayed on the open internet for about 11 months. The material included 181 logins and passwords of authorised users, data on more than 6,000 security agents and instructions for running the system on computers and phones.

With that material, UOL’s reporters built an interface to browse camera images on a map of the city. In a test on 7 October they saw their own images from eight private cameras in the Campos Elíseos district of central São Paulo.

They also reached images from public sites, among them health units and daycare centres. UOL said some credentials gave direct access to the technology platform without a second login step, and that tools allowed searches by name, CPF tax number, vehicle plate and incident record.

Rafael Alcadipani, a public-security professor at the Fundação Getulio Vargas (FGV), a Brazilian university, told G1 that a kidnapper could learn about a target and a criminal could learn where police cars are. A specialist quoted by UOL added that some interfaces could let outsiders insert false facial-recognition or number-plate records.

How the City Answered

São Paulo city hall confirmed in a written note that data had leaked, but called it an illegal act by one of more than 7,500 security agents and not a security failure. The agent was identified, suspended and is under investigation by the internal affairs office of the Guarda Civil Metropolitana (GCM), the city’s municipal guard.

The city said the data repository was taken offline and held no mention of access passwords, which differs from UOL’s account of 181 credentials. It added unique passwords, two-factor login and SMS codes for creating new passwords.

The note accused UOL of acting irresponsibly and misinforming the public by calling the case a security failure, and said the platform was never improperly used. It added that the programme is overseen by the municipal audit court and sends a transparency report to prosecutors every six months.

The city also said its cameras in public buildings cover only common areas, not consulting rooms or care areas. It noted that a captured image does not mean a person was registered or identified by the system.

Prosecutors Open an Inquiry

The São Paulo state prosecution service announced on 20 October that it will investigate the leak, G1 reported. The case went to its public-property prosecution offices, and the prosecutor in charge had not yet been named.

The Ministério Público is the independent state body that can investigate public authorities. An inquiry is not a finding of wrongdoing by the city or any person.

The Contractor, the Contract and the Cost

Sentinelx is the company responsible for Smart Sampa’s technology platform, and it joined the Smart City SP consortium that holds a R$588 million (about US$117 million) contract with the city, Veja reported. The company replaced Camerite in the consortium through an amendment signed in January 2026.

Veja said the contract makes the contractor responsible for system security and requires it to report abnormal events within 24 hours, with fines for breaches. We did not find a statement from Sentinelx in the reports reviewed.

Olhar Digital reported that the city has no access to the source code or the artificial-intelligence models behind facial recognition, and runs no independent audits of the algorithms. G1 put the programme’s running cost at about R$10 million a month (about US$2 million).

Smart Sampa Before the Leak

São Paulo launched Smart Sampa in 2024, and its control centre, opened in July of that year, runs around the clock on images from public and private cameras. Artificial intelligence compares faces with official databases of wanted and missing people and flags stolen or cloned vehicles.

The city says the programme has helped capture 3,628 fugitives and locate 284 missing people. A study by the Centre for Security and Citizenship Studies (CESeC), called “Smart Sampa vigia, mas não protege”, found no statistically significant fall in thefts, robberies or homicides between March 2024 and April 2025, which the city disputes.

Olhar Digital reported that 268 people were taken to police stations after facial-recognition alerts between November 2024 and May 2026 and then released. In 75 of those cases the identification was inconsistent, in 181 the warrants were outdated and in 12 there were registration problems.

Why the Smart Sampa Leak Reaches the Runoff

Flávio Bolsonaro’s government plan promises a national facial-recognition system inspired by Smart Sampa and by the state government’s “Muralha Paulista”, with more than 1 million new cameras, Terra reported from the plan text. He faces President Luiz Inácio Lula da Silva of the Workers’ Party (PT) in the runoff on 25 October.

We did not find a response from the Bolsonaro campaign to the leak in the reports reviewed. The programme itself is run by Mayor Ricardo Nunes of the Brazilian Democratic Movement (MDB), not by the federal government.

What It Means for You

Residents and visitors in São Paulo should know that the network combines public cameras with private ones, such as condominium and shop cameras. Terra reported that some agreements keep recordings for up to 14 days.

Businesses that connect cameras to the network can ask the city who can see their images and how access is logged. Our guides to Brazil Security and Crime Explained 2026 and Who Dominates Brazil, Elites and Regions Explained give the wider background.

Travellers planning a trip can use our São Paulo expat city guide and What to Do in São Paulo in October 2026. Nothing in the reports reviewed suggests visitors face any new danger from the leak.

What Is Not Known

UOL’s original article could not be opened for this report, so its findings rest on the city’s own note and on G1, Jovem Pan, Olhar Digital, Terra and the Record network’s news site, which summarise it. Where a detail comes from UOL alone, the text says so.

It is not known where the repository was hosted, who put it online, or whether anyone besides UOL used the credentials. The reports also do not say when the access data stopped working, or whether the agent acted on purpose.

It is also unknown whether prosecutors will examine the contractor as well as the agent, and whether the national data-protection authority will act. All amounts here use the Central Bank of Brazil’s PTAX selling rate of R$5.014 per US dollar on 20 October 2026.

Frequently Asked Questions

What is the Smart Sampa leak?

UOL reported that access data for the Smart Sampa camera network stayed on the open internet for about 11 months. It allowed access to images from more than 58,000 cameras, according to the report.

Did the city of São Paulo admit the leak?

Yes, the city confirmed that data leaked but denies a security failure. It blames one security agent, who was suspended and is under internal investigation.

Who is investigating the Smart Sampa leak?

The GCM internal affairs office is investigating the agent, and the state prosecution service announced its own inquiry on 20 October. No prosecutor had been named when the news broke.

What is Smart Sampa?

Smart Sampa is São Paulo’s camera and facial-recognition network, launched in 2024 under Mayor Ricardo Nunes. The city says it has helped capture 3,628 fugitives and locate 284 missing people.

Why does the leak matter for the Brazil runoff?

Flávio Bolsonaro’s plan promises a national system inspired by Smart Sampa, so the leak feeds a debate about that proposal. The runoff takes place on Sunday 25 October 2026.

Sources: G1, 20 October 2026; Record network news site, 20 October 2026; Jovem Pan, 20 October 2026; Olhar Digital, 20 October 2026; Terra, 20 October 2026; Veja, 20 October 2026; UOL, 20 October 2026 (original investigation); Central Bank of Brazil, PTAX rate of 20 October 2026.

Editorial responsibility: Matthias Camenzind, Editor-in-Chief · Editorial standards · Report an error

The Rio Times · Power Map

See who really holds power in Latin America

Click to open the Power Map →