Hotmart Data Incident: What Happened, What the Company Says, and How to Protect Yourself

Hotmart, the Brazilian platform that many engineers, trainers and consultants use to sell courses, e-books and digital products, has started emailing users about a security incident involving their personal data. We reviewed one of these notices. Below is a plain summary of what it says, what it means in practice, and what you should do — whether or not you received one.

What happened

According to the notice, on October 12, 2026 Hotmart became aware of unauthorized access to personal data in its systems. The company states that there was no improper movement of funds — in other words, no money was moved out of accounts as a result of the incident.

The notices began arriving in mid-November. Hotmart explains the gap: it chose to contact each user only after a detailed review of its system records, so it could tell each person exactly which of their data was involved rather than send a generic warning.

At the time of writing, we have not found independent public reporting on the scope of the incident (how many users, which systems, or how access was obtained). Everything below is based on the company's own notice.

What data was exposed

The notice lists the data involved for each individual user, so the list may differ from person to person. In the notice we reviewed, the affected data was:

• Name
• Email address
• Transaction volume (how much the account moves on the platform)
• Device information (collected by Hotmart as a security measure)

The notice does not mention passwords, card numbers or bank account details for this user. Its general "risks" section, however, also talks about identification data combined with salary or banking information — so read your own notice carefully and check exactly which fields it lists for you.

What Hotmart says it did

The company describes two layers of response:

Before the incident, it says it already had access controls, multi-factor authentication, system monitoring, access logging and penetration testing in place.

After detecting the access, it says it:

1. Blocked the third party's access
2. Rotated (replaced) credentials
3. Restricted the creation of new access
4. Reported the incident to Brazil's data protection authority, the ANPD (Agência Nacional de Proteção de Dados), within the legal deadline under the LGPD

Questions go to Hotmart's Data Protection Officer at privacy.support@hotmart.com.

Why this matters more than "just an email leak"

A leaked email address on its own is a nuisance. A leaked email address plus your name plus how much money you make on a sales platform is a ready-made target list.

Think about it from an attacker's side. They know you sell on Hotmart, they know roughly how much you earn there, and they can write to you by name. That is exactly the raw material for convincing, targeted phishing:

• A fake "Hotmart security team" email about "your affected account" asking you to "verify your identity"
• A fake payout or tax notice that matches the size of your real revenue
• A WhatsApp message or call from "Hotmart support" or "your bank" that already knows your details, offering to "help" with the incident
• Fake credit, loan or "compensation for the data breach" offers

Hotmart's own notice warns about these same scenarios: impersonation of Hotmart, banks or other organizations; fake account-update requests; fake credit or benefits; requests for more information or payments; and accounts or contracts opened in your name.

The incident notice itself is the perfect phishing template. Expect copies of it with malicious links.

What to do right now

If you have a Hotmart account — as a producer, affiliate or buyer — work through this list today:

1. Read your own notice carefully and note which data fields it lists for you.
2. Do not click links in any message about this incident. Go to Hotmart by typing the address yourself or using a bookmark you already had.
3. Treat any contact that "knows your data" as suspicious. Knowing your name, email or sales volume does not prove someone is from Hotmart — that is exactly the data that leaked.
4. Never share passwords, one-time codes, or 2FA codes with anyone, by any channel, for any reason. No legitimate support team needs them.
5. Change your Hotmart password if you reused it anywhere, and change it on every other site where you used the same one.
6. Turn on two-factor authentication on Hotmart and on the email account linked to it.
7. Check your payout settings (bank account, Pix key) on Hotmart and confirm nothing has changed.
8. Watch your bank statements for transactions, contracts or credit requests you do not recognize.
9. In Brazil, check Registrato, the Central Bank's free service that lists bank accounts, loans and Pix keys registered under your CPF. Unknown entries are a red flag.
10. If something looks wrong, contact the institution involved through its official channels and inform Hotmart at privacy.support@hotmart.com.

Digital security best practices (for everyone)

Incidents like this will keep happening, at Hotmart and elsewhere. The goal is to make a leak of your data as useless as possible to an attacker.

Passwords

• Use a password manager (Bitwarden, 1Password, KeePassXC or your browser's built-in manager) and let it generate a unique password for every site. Password reuse turns one breach into many.
• A password manager also protects you from phishing: it will not auto-fill your password on a look-alike domain.

Two-factor authentication

• Turn on 2FA everywhere that offers it, starting with your email, your bank and every platform that pays you.
• Prefer an authenticator app or passkeys/security keys over SMS codes. SMS can be intercepted through SIM-swap fraud.
• Store your backup codes offline.

Email hygiene

• Your email account is the master key to everything else, because every "forgot password" link goes there. Protect it first and best.
• Consider a separate email address just for financial and payout platforms, not published anywhere.
• Before acting on any email, check the real sender domain, not just the display name. Hover over links before clicking.

Verify through a second channel

• If a message asks you to pay, update data, or "confirm" something urgently, stop. Urgency is the attacker's main tool.
• Verify by contacting the company through a channel you already know — the official app, a saved bookmark, the number on the back of your card. Never use the phone number or link in the suspicious message.

Monitor your exposure

• Check whether your email appears in known breaches at Have I Been Pwned and sign up for alerts.
• Turn on transaction notifications in your banking apps so unexpected movements show up immediately.
• In Brazil, consider credit-bureau alerts for new queries or contracts under your CPF.

Keep devices clean

• Keep your operating system, browser and apps updated.
• Install apps only from official stores.
• Lock your phone with a strong PIN or biometrics; it holds your authenticator and your banking apps.

A note for the IIoT and OT community

Many people in our field run side businesses — courses, templates, consulting — on platforms like Hotmart. The lesson carries over directly to plant floors: most serious intrusions do not start with exotic exploits, they start with a convincing message and a reused credential. The same person who would never expose a PLC to the internet will sometimes type their password into a well-made fake login page.

If your Hotmart password, or any variation of it, is also used for a VPN, remote-access tool, historian, SCADA or engineering workstation, change those today. Personal breaches become corporate breaches through password reuse.

Bottom line

According to Hotmart, no money was moved and the access was contained. But the data that leaked — names, emails and transaction volume — is exactly what makes targeted fraud work. For the next few months, treat any message about Hotmart, your payouts or this incident with suspicion, verify everything through channels you already trust, and use the moment to fix your passwords and 2FA for good.

Source: Hotmart's data incident notice to users (Hotmart – Launch Pad Tecnologia, Serviços e Pagamentos Ltda.), received November 2026. IIoTjob is not affiliated with Hotmart.