Situación Nacional de Ciberseguridad - Junio 2026 - Brasil

Relevant incidents in Brazil

National Civil Defense alert system

On June 20, the Defesa Civil cell alert system was temporarily shut down after an unauthorized message classified as "Extreme Alert" was sent. Reuters reported that the notice, which included the word "misanthropy," was transmitted remotely to multiple states and that the case was handed over to the Federal Police. Bloomberg and Bloomberg Línea added that the suspension was carried out around 1:30 a.m. and that the government had not set a date to restore the platform. CNN traced the initial spread from Paraná to São Paulo and Rio de Janeiro, while The Next Web said the same content later reached at least seven states.

What stands out most in this incident is not just the intrusion, but the breach of trust it exposed. The system was designed to automatically deliver risk messages to anyone located in potentially affected areas. Exame explained that normal operating model and, precisely for that reason, an unauthorized broadcast alters the logic of the entire system. The episode sent a clear signal about Brazil's dependence on an emergency communication framework that needs redundancy, strong access controls and continuous operational verification.

MHE9 Logística Ltda, threat attributed to Gunra

Dexpose reported on June 12 that the Gunra group claimed to have attacked MHE9 Logística Ltda, a logistics firm based in Brazil, and threatened to publish a full data dump if negotiations did not begin. The report did not show public confirmation from the affected company, but it did reflect a classic double-extortion play, with pressure aimed at forcing contact and increasing reputational costs.

iFood, confirmed December 2025 breach disclosed in June

HackRead reported on June 4 that iFood confirmed a breach that occurred in December 2025 and exposed data from approximately 1.2 million users. The compromised information included names, phone numbers, addresses and CPF, but not passwords, banking data or credit cards. The company said it acted in line with ANPD regulations and chose not to notify users individually, arguing that the incident did not represent relevant risk or harm under the applicable regulatory criteria.

Federal government and cumulative incident exposure

Folha de S.Paulo, citing the GSI, reported that Brazilian federal government systems recorded 6,774 cyber incidents through early June. This is not a single campaign, but an institutional snapshot that reinforces the broader picture for the month. At the same time, several security ecosystem sources listed Brazilian organizations on leak sites or ransomware trackers, suggesting distributed exposure across ministries, private companies and service entities.

Threats and active campaigns in Brazil

Ransomware and extortion

The month’s dominant pattern was ransomware and extortion. Daniel Donda’s weekly radar for June 15 to 22 listed five Brazilian organizations among 100 affected worldwide. The names include Editora Irmãos Vitale, Super Finishing, mupras.com, coemi.com.br and saude.mt.gov.br, tied to Payload, WorldLeaks, Krybit and LockBit5. Although several entries rely on leak-site posts rather than victim statements, the pattern matches campaigns designed to increase pressure through public exposure of data.

Another case flagged during the month was Gunra against MHE9 Logística Ltda. That was followed by outside references to a Brazilian victim on BreachSense, META, linked to BravoX, although the available coverage did not allow that point to be treated as direct confirmation. The editorial takeaway is different, the extortion ecosystem did not slow in June and reached multiple sectors, from education and manufacturing to logistics and occupational health.

Brazil also appeared in context reporting that did not describe a specific incident, but did point to a market trend. Dinamio noted that in March 2026 the country ranked eighth globally among the most affected by ransomware, with 1.8% of reported attacks worldwide. Valor Econômico, meanwhile, cited SonicWall data and reported a 25% increase in ransomware attacks in Brazil. Operationally, that points to an environment where defense teams must deal with active campaigns and a broad underlying technology exposure.

Fraud and phishing

The only case in this category in this month’s material was G1’s reference to 553 million phishing attempts in Brazil during 2025, citing Kaspersky data. It does not describe a specific June attack, but it does show the structural level of pressure still affecting users and small and midsize businesses. The same content says 43% of cyberattacks mapped in Latin America targeted SMEs, a useful indicator of the region’s most likely victim profile.

APT, intrusion and infrastructure abuse

The consolidated material did not show a classic APT campaign with strong attribution for Brazil during June. It did, however, show abuse of critical public infrastructure, especially in the case of the Defesa Civil alert system, which can be read as intrusion, message diversion and sabotage of trust. Technically, the harm did not come from encryption or confirmed large-scale exfiltration, but from the malicious use of a state emergency channel.

Critical vulnerabilities affecting Brazil

The operational read of this table is straightforward. June's critical flaws were not confined to a single vendor or a single type of environment. Exposure appeared in networking, collaboration, ERP, endpoint protection, and domain controllers. For Brazil, where sectors with different levels of maturity coexist, the priority is not abstract CVE monitoring, but identifying which platforms are actually deployed and which ones face internet exposure or elevated privileges.

Regulation and compliance in Brazil

June brought two clearly documented regulatory moves and several supporting administrative instruments. Anatel established the Artificial Intelligence Governance Policy through Internal Resolution No. 554, the TSE approved Resolution No. 23.763 on Information Security Policy, the CJF published rules on incident reporting and LGPD, and the Secretaria de Governo Digital released a guide for privacy notices aligned with Brazilian rules. Added to that is ANAC's Resolution No. 806 on unmanned aircraft, which is not a cybersecurity standard in the strict sense, but is part of the sector's technological control framework.

The other key document was the "Guia de Referência para Prevenção e Resposta a Ransomware" published by Gov.br. Its practical value lies in organizing a response that many organizations still handle ad hoc, especially when an attack crosses the lines between IT, legal, privacy, and operational continuity. The release of that material in the same month as a wave of extortion and an intrusion into the public alert system was no coincidence. It shows that the Brazilian state is trying to establish a methodological baseline for response and prevention.

The month's legal relevance also appeared in Dolutech's comment on CVE-2026-20253. The source notes that a successful exploitation of Splunk that stores personal data can trigger notification obligations under the LGPD before the ANPD. That kind of observation matters because it turns a technical vulnerability into a compliance issue, especially for organizations that concentrate logs, monitoring, and sensitive data.

Most Affected Sectors in Brazil

At least eight sectors had documented incidents during June. The strongest signal appeared in the public sector, driven by the Defesa Civil incident and by the ransomware radar that includes saude.mt.gov.br. There was also activity in education, with Editora Irmãos Vitale; in manufacturing, with Super Finishing; in business services, with mupras.com; in logistics, with MHE9 Logística Ltda; and in health, both because of the regional ransomware context and the reference to META as an occupational health provider in an aggregator source.

The sector breakdown does not point to a single front in crisis, but to a cross-sector spread. That is typical of environments where extortion targets quick payment or maximum visibility, and where attacks on public or alerting systems create a disproportionate impact relative to the technical effort required. In Brazil, the public sector was not only a victim, it also issued new rules and guidance, which adds a double burden on security teams: respond to incidents and, at the same time, implement new controls and policies.

The sector view also raises an alert for SMEs and intermediate suppliers. The month’s material insists that phishing and other entry vectors continue to hit small and medium-sized companies, while ransomware takes advantage of exposed surfaces such as RDP, VPN, RDWeb and compromised credentials. In other words, the weakness is not confined to large corporations or the state. It is spread across the service chain.

Trends and signals to watch in Brazil

There is no month-over-month baseline, because this is the first archived period with this indicator format for Brazil. Even so, the June snapshot highlights several signals that merit monitoring in July.

First, abuse of public alert and notification systems. The Defesa Civil case showed that an emergency system can become a panic vector if it is not properly authenticated and segmented. If the incident is confirmed as an intrusion or platform abuse, the country will need to revisit architecture, message validation, and contingency procedures.

Second, the overlap between ransomware and service sectors. The cases observed in June were not limited to one industry, but spread across education, logistics, manufacturing, occupational health, and the public sector. That diversity makes vertical responses harder and pushes attention toward cross-cutting controls, especially identity, backups, and exposed remote services.

Third, the intersection of critical vulnerabilities and compliance. This month’s sources show that a real-world exploitation can quickly trigger regulatory obligations. That is especially relevant in environments that process personal data, where response time is no longer measured only in technical hours, but also in notification deadlines and legal handling.

Fourth, there is no sign of a pause in extortion campaigns. The month left enough evidence to suggest that active groups will keep pressuring Brazilian victims as long as they find exposed systems, reused credentials, or weak controls.

Security recommendations for teams in Brazil

1. Review public alert channels and message authentication mechanisms, with failover testing, integrity logs, and safe shutdown procedures.
2. Prioritize patches for CVE-2026-20245, CVE-2026-20253, CVE-2026-46817, CVE-2026-41091 and CVE-2026-41089, based on actual exposure in the inventory.
3. Audit remote access, especially RDP, VPN and similar services, with emphasis on MFA, privileged account control and closing orphaned access.
4. Verify offline or immutable backups and test restoration, not just whether backups exist.
5. Review how personal data is handled in observability tools, SIEM and logging, because a breach of those platforms can trigger notification obligations.
6. Harden email, browsers and anti-phishing filters for SMB and third-party users, which remain a recurring entry point.
7. Map the extortion surface by vendor, because several incidents this month point to mid-sized companies with limited exposure but high operational impact.
8. Cross business continuity, legal and privacy in a single playbook, especially in public and regulated sectors.

Material limitations

This report was prepared exclusively from the material provided for June 2026 and without internet access. Several references from the month come from press coverage or aggregators that attribute events to leak sites, so it was not always possible to turn every signal into direct confirmation from the victim or of the impact.

There are also differences across sources regarding the exact scope of some incidents, particularly the Defesa Civil episode and the number of messages or statuses affected. To avoid overstatement, only the data that appears repeatedly or is supported by the available sources in the corpus was consolidated. When a news item described an attribution as likely or alleged, that condition was preserved in the editorial reading.

The critical vulnerabilities section includes only CVEs explicitly mentioned in the sources from the period. No additional flaws were added and no unmentioned products were inferred. The same caution was applied to ransomware cases, where some radar or aggregator entries were treated as source attributions and not as absolute confirmations.