Exposed Password in a Repository: Lessons From Smart Sampa
Imagine someone on the team, with the best intentions, saves a list of logins in a file and publishes it to a repository they believe is private. Months later, it turns out to be public. Something along these lines was reported in October 2026 about Smart Sampa, the camera system of the city of São Paulo, Brazil. The case shows how an exposed password in a repository can open doors far bigger than the file it was in.
What was reported about the Smart Sampa case
According to a report by UOL published on October 20 and picked up by TecMundo and other outlets, data from the system was accessible in a public repository for about 11 months. Per the report, it included 181 logins and passwords of authorized users and information on more than 6,000 agents. The article also says some logins followed a predictable pattern and that two-step verification was only implemented after questions were raised.
The São Paulo City Hall confirmed that data was exposed and said it is investigating. It also disputes the description: it states there was no security flaw in the platform and attributes the episode to the conduct of a public employee with authorized access. Because the investigation is ongoing, treat the details as press and City Hall accounts, not a final conclusion.
Why this matters for your company
You don't need to run a camera system to face something similar. Credentials often end up in unlikely places: shared spreadsheets, chat messages, scripts, code repositories and project folders. When a password leaks, the risk is not limited to the original file. If the account does not require a second confirmation, whoever finds the password can simply sign in.
Then there are vendors. The report says the credentials also gave access to the platform of a company involved with the system. In many organizations, partners and third parties access the environment with accounts nobody has reviewed in years.
How to protect against an exposed password in a repository
No single control solves this, but these steps reduce the risk of a leaked password turning into unauthorized access:
Require MFA on every account, including vendors and partners. In Microsoft Entra ID, security defaults and Conditional Access policies help make it mandatory. See the walkthrough in how to turn on MFA in Microsoft 365 for all accounts.
Use Conditional Access to limit where and how each account can sign in, for example by blocking sign-ins from unmanaged devices. Available features depend on your plan.
Don't store passwords in files, spreadsheets or repositories. Use a password vault or secrets manager and scan regularly for credentials forgotten in code and folders.
Rotate exposed passwords immediately and avoid predictable patterns, such as the same password structure for every user.
Review access on a schedule. List who has access to what, remove what is no longer needed and include third-party accounts in the review.
If personal data is exposed, Brazil's LGPD expects the company to assess the incident and, when there is relevant risk, notify the ANPD and affected individuals.
Source
TecMundo (Estadão) report of October 20, 2026, citing UOL's investigation and the São Paulo City Hall's statement: Smart Sampa: entenda o que vazou e quem são as empresas que operam o sistema de câmeras de SP (in Portuguese).
Need help?
WRA IT, a Microsoft partner, helps companies set up MFA, Conditional Access and access reviews in Microsoft 365. Get in touch at www.wra.com.br.
Comments