Ransomware in Brazil's government and healthcare: 2024–2026 cases

Municipalities, hospitals and health software vendors: the ransomware attacks publicly confirmed in Brazil between 2024 and 2026 and what they teach.

2026-10-28

Between 2024 and 2026, ransomware moved from being a corporate problem to a recurring threat to Brazilian public services and healthcare. This roundup covers cases publicly confirmed by victims or reported on the basis of investigations.

The trend

Citing data from CTIR Gov, the federal incident response centre, ESET reported that incidents against public bodies in seven months of 2025 exceeded the annual totals for 2021, 2022 and 2023 (WeLiveSecurity). Check Point placed Brazil among the ten countries most hit by ransomware in Q1 2026, with 2% of global victims (IT Forum). A Sophos survey of 71 Brazilian IT leaders found that 56% of attacks led to data encryption and the average recovery cost, excluding ransom, was US$1.05 million (Sophos).

Local government

Itu (SP), August 2024: internal systems corrupted in an attack attributed to Phobos; staff reverted to manual work (Baguete).
Ponta Grossa (PR), August 2024: servers shut down as a defensive measure (Baguete).
Ivinhema (MS), March 2025: taxpayer data encrypted and a US$1 million ransom demanded; a second attack followed hours after restoration (Campo Grande News).
Porto Nacional (TO), June 2025: systems offline; daily backups allowed recovery of about 20 TB (Conexão Tocantins).
São José do Rio Preto (SP), June 2025: the attack also cut phone access to emergency and primary care services (WeLiveSecurity).

Healthcare

On 6 October 2024, the Hospital da Criança de Brasília shut down all systems after an attack police classified as ransomware, and switched to contingency procedures (Jornal de Brasília). In September 2025, the KillSec group claimed theft of more than 34 GB and about 95,000 files, including lab results and X-rays, from MedicSolution, a clinic software provider; researchers said the data sat in misconfigured cloud storage (Convergência Digital).

In the pharmacy sector, the Gunra group claimed an attack on Grupo Jorge Batista (Farmácias Globo) in Piauí, which left the chain unable to process orders or record sales and was accompanied by a threat to delete data if no ransom was paid (WeLiveSecurity). In Paranhos (MS), attackers demanded R$12,000 to release encrypted files; the city said daily backups preserved its database. In June 2025, the Federal Police also launched Operation Timeout against groups behind attacks on public institutions.

A common thread runs through these cases: small and mid-sized public bodies with limited IT teams, legacy systems and services that citizens depend on daily, such as tax invoices, property tax payments and appointment scheduling. When those systems stop, staff fall back on paper, and residents become targets for follow-up scams that use the stolen data.

Supply-chain risk

In August 2026, more than 20 municipal bodies in Espírito Santo had portals defaced by the BLCKORDER group after a shared IT provider was compromised. It was not ransomware, but it shows the same concentration risk (ES Hoje).

Lessons

Offline, daily backups made the difference in Porto Nacional and Paranhos.
Third-party providers are the weakest link.
Cloud misconfiguration can expose data without any intrusion.
Manual contingency plans keep hospitals running.