CSIDB logo
Incident

Prefeitura de Japorã

Incident posture

Attack window
May 2025
Location
Brazil
Status
Unknown
CIA posture
Available to members
Updated
2026-06-19 03:49

Linked entities

Victim
Prefeitura de Japorã
Threat actors
0 actors
Sources
1 source

Timeline

Occurred
May 2025
Discovered
Pending
Disclosed
Pending
Resolved
Pending

Summary

Hackers gained unauthorized access to the official website of the municipal government and posted a false article claiming the president had died of a heart attack, complete with a fabricated image of him in a coffin. The misinformation appeared in search engine results and spread quickly across social media, alarming local residents. Officials confirmed the breach, removed the content immediately, and began collecting evidence to file a criminal complaint with the civil police. They characterized the incident as a cyberattack, noting no ransom demand or additional extortion attempts were made. Authorities will investigate to identify those responsible for the intrusion and the dissemination of the false news.

Motives

Detailed motive labels are available to members.

1 motive

TTPs

Detailed technique labels are available to members.

1 technique

Description

On May 8, 2025, the official website of the Prefeitura de Japorã, located 434 kilometers from Campo Grande, was compromised by hackers. The attackers gained access to the municipal system and published a false news article claiming the death of President Luiz Inácio Lula da Silva. The fabricated story bore the headline “Morre Lula aos 79 anos” and asserted that the president had suffered a fatal heart attack, accompanied by a doctored image of Lula inside a coffin. The false page appeared in Google search results with a direct link to the municipal portal.

Upon discovery, the Municipal Government Secretary, Nivaldo Dias, confirmed the incident to the press and stated that the administration had immediately ordered the removal of the offending content. He explained that the team was collecting screenshots of the compromised page to file an official report with the Polícia Civil for criminal investigation. Dias characterized the event as a cyberattack, noting that the breach was limited to the publication of the fake news and that no ransom demand or additional malicious activity was observed. He emphasized that the municipality’s response focused on preserving evidence for legal proceedings.

The Polícia Civil has assumed responsibility for investigating the intrusion, aiming to identify those behind the breach and assess any possible criminal dissemination of false information. The false report generated concern among local residents and circulated rapidly across social media platforms, amplifying its reach beyond the municipal website. As of the article’s publication, no further details about suspects or investigative outcomes had been disclosed.

Sources

Sources available to members: 1 source.

CSIDB