Sabesp, the water and sanitation company that serves about 30 million people in Brazil's São Paulo state, has picked the security layer for what it calls the world's largest smart water metering project. On 4 August 2026, the utility named IDEMIA Secure Transactions as the eSIM supplier for 4.4 million connected meters across São Paulo city and São José dos Campos, in a 14-year partnership with Vivo, the Brazilian mobile operator owned by Spain's Telefónica.
Vivo had won the main contract a year earlier, when Sabesp told investors in August 2025 that it had signed a deal worth R$3.8 billion (about US$700 million) with Telefônica Brasil, which trades as Vivo, and a sister company. The filing covered ultrasonic meters, installation and connectivity, and it described the work as an NB-IoT metering project larger than any similar scheme known in the water sector. NB-IoT, or Narrowband IoT, is a low-power version of cellular that mobile operators run for devices sending small amounts of data.
Installation began in February 2026, according to Brazilian telecom outlet Teletime, which reported that Sabesp aims to finish São José dos Campos this year and São Paulo city by 2029. Each meter will report hourly, which Denis Maia, Sabesp's executive director of customers and technology, said gives the company and its customers "greater visibility into hourly water consumption and the rapid identification of anomalies and leaks."
Why Every Litre Counts In São Paulo Now
That visibility arrives in a dry year for the region, because the Cantareira reservoir system, which supplies roughly 9 million people around the city, stood at 37.7% of its useful volume in late July, according to local newspaper Folha de Alphaville. Sabesp says it faces no risk of shortage, yet it has cut water pressure at night since August 2025 to stretch supplies, and in late 2025 the system fell to its lowest level in almost a decade.
The bigger drain sits inside the pipes, since Sabesp loses 29.4% of the water it supplies, according to trade site Saneamento Básico. About 19 points of that go on physical leaks and roughly 10 on theft, fraud and tampered meters, and the company has set aside R$9.7 billion through 2029 to bring the figure down, with about R$4 billion of it going to smart metering.
Those numbers look better than Brazil's as a whole, since utilities nationwide lost 39.5% of their treated water in 2024, enough to supply 77 million people, according to the Instituto Trata Brasil and consultancy GO Associados. A federal ordinance now asks utilities to cut losses to 25% by 2033.
What 4.4 Million Meters Will Change
Cutting those losses starts with the meter on the wall, and for the people who pay the bill the change is immediate: nobody needs to visit to read it, and customers can follow their consumption hour by hour in Sabesp's app. The system sends alerts through WhatsApp, the app or email when usage jumps, which often signals a leak inside the home, one of the losses that until now only showed up as a nasty surprise on the next bill.
A Revenue Protection Tool As Much As A Leak Detector
For Sabesp, the same data doubles as a fraud alarm, and the company's own titles give that away. Luiz Renato Fraga Rios, who leads revenue protection at Sabesp, said the goal is to "transform our customers into effective managers of their water consumption," while Teletime reported that the meters will raise an alert if someone tampers with them or pulls them out of place.
That feature targets a real bill: Sabesp logged more than 52,000 cases of illegal connections, tampered meters and other fraud in 2025, and it ran over 212,000 inspections in a single enforcement operation. A meter that reports every hour and flags its own removal lets the company spot suspicious patterns from a control room instead of sending inspectors door to door.
Why The SIM Became The Story
Every one of those alerts is only as trustworthy as the identity of the meter sending it, which is where IDEMIA comes in. The French company supplies eSIMs, SIM chips built into the meter whose operator profile can change over the air, and a platform that manages them under SGP.32, the standard that the GSMA, the mobile industry's trade body, wrote for connected devices with no screen and no user.
A Standard Built For Devices Nobody Touches
Older eSIM rules worked for phones, where a person scans a code, or for machine-to-machine links that tied each device closely to one operator's systems. SGP.32 adds a remote manager, known as the eIM, that lets the owner of a fleet switch connectivity profiles in bulk without touching the hardware, which matters a great deal when the hardware sits in 4.4 million homes and basements.
IDEMIA says it launched the first fully GSMA-certified SGP.32 solution, covering both the chip and the management server, in August 2025, and in March 2026 it teamed up with Tele2 IoT and Cisco on what the three companies called the first commercial end-to-end SGP.32 service. Sabesp gives it a showcase on a scale no pilot can match, and we looked at why control over that remote manager has become contested ground in the fight over who controls the IoT SIM.
Security Meant To Outlast The Contract
Scale is one test and time is another, since the deal runs for 14 years, long enough for today's encryption to start looking dated, so IDEMIA pitches its eSIM as having "cryptographic agility," meaning operators can update the algorithms on the chip in the field. The company ties that to post-quantum readiness, the effort to prepare for future quantum computers that could break today's encryption, though the release does not say which algorithms it will use or when.
For a utility, the practical benefit is simpler: a meter installed in 2027 should not need a site visit in 2035 because its security or its network aged out. Our look at how the UK's network switch-off is stranding devices shows what happens when long-lived hardware outlives its connection.
From Sigfox To The Mobile Network
Sabesp learned that lesson once already, when in 2021 it rolled out about 100,000 smart meters for its largest customers around São Paulo, and 92,000 of them sent data over Sigfox, a low-power network that WND ran in Brazil. Within a year, the French company behind Sigfox had entered receivership, and a French court handed it to Singapore's UnaBiz in April 2022, a reminder of how much a long metering plan depends on a network company's health.
This time Sabesp has chosen a licensed cellular network run by Brazil's largest IoT operator by Teletime's count: Vivo held 18.9 million IoT connections at the end of 2025, ahead of Claro and TIM. That choice differs from utilities elsewhere, such as the Danish city of Aarhus, which put 69,000 water meters on LoRaWAN, or India's Uttar Pradesh, where a million meters talk to each other over a mesh network.
Each route trades control for convenience, because a utility that runs its own LoRaWAN owns the network but must maintain it, whereas one that buys NB-IoT from an operator gets national coverage without building towers, and relies on standards such as SGP.32 to keep the option of switching operator later.
A Newly Private Utility On A Deadline
Sabesp is moving this fast partly because its owners have promised to. São Paulo state sold control of the company in July 2024 for about R$14.7 billion, with energy group Equatorial taking 15% as reference investor, and the new management plans R$70 billion of investment through 2029. That plan brings the targets of Brazil's 2020 sanitation law, water for 99% and sewage collection for 90% of people, forward by four years from the legal deadline of 2033.
Meters that read themselves also cut costs that the old model needed, including the people who walked the streets reading them, and Teletime noted that Sabesp expects long-term savings from ending manual reads. Sintaema, the sanitation workers' union, says Sabesp has cut more than 2,000 jobs since privatisation, and some customers have complained about sharply higher bills, so accurate hourly data could either settle disputes faster or give critics new material.
What Other Utilities And Suppliers Should Watch
The first thing to watch is whether hourly data turns into lower losses, since the case for the whole programme rests on Sabesp shaving points off that 29.4% figure. São José dos Campos, due for full coverage this year, will give the first clean read of whether a fully metered city loses less water and suffers less fraud than it did before.
The second is who controls the eSIM remote manager in practice. The release does not say whether Sabesp or Vivo operates it, and that detail decides whether the utility could move its meters to another network in, say, 2035 without the current operator's cooperation.
The third concerns the claim itself, because "world's largest" is the companies' own description and no independent body ranks these projects. Even so, 4.4 million meters on one cellular IoT contract is large by any measure, in a Brazilian market that reached 58.8 million IoT connections in July, according to Teletime's monthly count.
The Leak Sabesp Is Really Chasing
Strip the programme back and Sabesp is buying certainty about two things it has never measured well: where its water goes after it leaves the treatment plant, and who is taking it without paying. The eSIM is the least visible part of that purchase, yet it carries the weight of the other two, because a fraud alert from a meter whose identity someone can fake is worth nothing, and a meter that cannot change networks becomes a liability long before its battery runs flat.
That makes Sabesp a test case for utilities far beyond Brazil that are weighing cellular against private networks for their next metering round. If São José dos Campos shows a measurable drop in losses by 2027, operators and SIM suppliers will have a reference customer that no marketing claim can buy, and if it does not, the problem will lie in how Sabesp acts on the data rather than in the chips that collect it.
