VandaTheGod

Profile narrative

The threat actor known as VandaTheGod also uses the alias Vanda the God and has been identified as Marcos Roberto Correia da Silva, a Brazilian national who was 24 years old at the time of his arrest in 2021. He operates primarily from Brazil, where law enforcement linked him to the largest personal data breach in the country’s history. Federal Police arrested him during Operation Deepwater after seizing his computer and phone. The actor’s online presence includes a Twitter account used to claim responsibility for attacks and to communicate with researchers and journalists. No other aliases or affiliations have been publicly disclosed.

His activities show a mix of financially motivated data theft and hacktivist‑style disruption. In the 2021 Brazil incident he allegedly exfiltrated CPF and CNPJ numbers, full names and addresses of hundreds of millions of individuals and offered the data for sale on underground forums. The 2019 New Zealand healthcare website defacement was initially described as a protest action, though the actor later stated that his intended targets were government and educational entities. Similar defacement campaigns targeted numerous government sites worldwide, where the actor posted anti‑government messages demanding more jobs, more hospitals and an end to police corruption. He also claimed responsibility for defacing the University of Florida’s websites, which aligns with his stated focus on educational institutions. Throughout these operations he used social media to announce and justify his actions.

Observed tactics include replacing website home pages with political messages and the illicit acquisition and distribution of personal data through online channels. The reporting does not mention any specific malware families, exploit kits or detailed initial‑access vectors used by the actor. For the data breach, a second individual using the alias JustBR was identified as the party who listed the stolen records on RaidForums, while the defacement incidents were attributed solely to VandaTheGod. No public sources have linked the actor to a state sponsor or to a larger criminal consortium. Notable campaigns referenced in the coverage are the Brazil data breach that prompted Operation Deepwater, the New Zealand healthcare website defacement, and the widespread government website defacement effort.

Incidents

Attributed incidents are available to members.