Nubank

In late March 2026, data belonging to more than 30,000 Nubank Colombia customers -- including full names, national ID (cedula) numbers, phone numbers, overdue amounts, payment histories and internal collection notes -- was exposed and offered for sale on a dark web forum (asking price ~$200 USD) by a seller using the handle 'Petro_Escobar.' Nubank confirmed the breach occurred not in its own systems but at two third-party debt-collection vendors it contracted with, EmergiaCC and Conalcreditos, and stated no passwords, encryption keys, or account/deposit information were exposed. The same threat actor reportedly also compromised BBVA Colombia collections data, suggesting a wider campaign against financial-sector collection vendors in Colombia.

In October 2020, co-founder Cristina Junqueira made controversial comments in a TV interview, saying Nubank could not 'lower its standards' when asked about including Black people in leadership. She said 'It doesn't work to allow in someone who will not be able to work with our team.' The remarks triggered customer backlash with many saying they would cancel accounts. Nubank issued a letter titled 'Nubank failed' promising to set racial inclusion goals.