Prefeitura Municipal de Itapemirim

Summary

The Prefeitura Municipal de Itapemirim in Brazil experienced a cyberattack compromising its digital process system, with attackers demanding ransom for system restoration following unauthorized access. A message in English was left by the perpetrators, disrupting municipal services and prompting technical teams to address the incident while involving competent authorities. No threat actor claimed responsibility for the intrusion, and recovery efforts were initiated without disclosing further details about the attackers' identity or the ransom terms.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On July 10, 2022, the Municipal Prefecture of Itapemirim in Brazil experienced a cyberattack targeting its digital process system. The municipality publicly disclosed the incident through an official statement on its Facebook page, confirming that attackers compromised systems during the overnight period. Criminal actors left a ransom message written in English demanding payment for system restoration. The attack disrupted municipal operations, impairing unspecified digital services critical to local administration. Municipal technical teams immediately initiated response efforts to resolve the system compromise, though the statement did not detail specific technical containment measures taken. Authorities activated relevant legal and investigative bodies to address the criminal aspects of the incident, though no specific agencies were named in the announcement. The public notification occurred within 24 hours of the attack detection, demonstrating prompt disclosure to citizens affected by service disruptions.

No ransomware group or threat actor claimed responsibility for the attack in the immediate aftermath. The municipality deliberately withheld identifying details about the attackers, including any group affiliations or technical indicators of compromise. Recovery efforts focused on restoring the compromised digital process system to operational status, though the timeline for full restoration remained unspecified in public communications. Service disruptions persisted during the initial response phase as technical teams worked to mitigate the attack's effects. The incident represented a confirmed ransomware event based on the explicit ransom demand and system encryption described in the municipal statement. Operational impacts were acknowledged without quantitative detail regarding financial losses or data compromise. The technical response remained ongoing at the time of the public statement, with no subsequent updates provided in the available source material.

Sources

Sources available to members: 2 sources.