Nubank

On July 10, 2026 a Sao Paulo labor court (first instance) ordered Nubank to pay R$40,000 in moral damages to a former employee, finding three abusive practices: routine exposure to explicit images in photo-verification work without adequate safeguards; a 2018 internal campaign involving simulated-nudity photos; and the June 7, 2023 dismissal of roughly 300 employees via a five-minute videoconference with microphones and chat disabled, treatment the judge called 'inhumane and cold' ('desumano e frio'). The court also reclassified the employee as a financial-sector worker with corresponding benefits. The ruling is subject to appeal; Nubank said the 2018 campaign materials were discontinued and that photo screening is now fully automated.

In late March 2026, data belonging to more than 30,000 Nubank Colombia customers -- including full names, national ID (cedula) numbers, phone numbers, overdue amounts, payment histories and internal collection notes -- was exposed and offered for sale on a dark web forum (asking price ~$200 USD) by a seller using the handle 'Petro_Escobar.' Nubank confirmed the breach occurred not in its own systems but at two third-party debt-collection vendors it contracted with, EmergiaCC and Conalcreditos, and stated no passwords, encryption keys, or account/deposit information were exposed. The same threat actor reportedly also compromised BBVA Colombia collections data, suggesting a wider campaign against financial-sector collection vendors in Colombia.

In October 2020, co-founder Cristina Junqueira made controversial comments in a TV interview, saying Nubank could not 'lower its standards' when asked about including Black people in leadership. She said 'It doesn't work to allow in someone who will not be able to work with our team.' The remarks triggered customer backlash with many saying they would cancel accounts. Nubank issued a letter titled 'Nubank failed' promising to set racial inclusion goals.