Cyber Incident Victim: Boa Esporte Clube
Date:
Mar 2017
Location:
Brazil
Summary
Anonymous Brazil targeted a Brazilian football club's website with dual defacements, protesting its hiring of a goalkeeper convicted of murdering his ex-girlfriend. Hackers replaced the site with messages demanding accountability for the victim's disappearance, alongside domestic violence statistics and imagery of the perpetrator and victim. The incident triggered significant backlash, leading two major sponsors to terminate partnerships with the club, citing reputational concerns and publicly requesting brand removal from digital assets. Public outcry on social media amplified pressure on corporate partners following the cyber attacks.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
On March 12, 2017, the official website of Brazilian second-division football club Boa Esporte (boaec.com.br) suffered two sequential defacement attacks attributed to Anonymous Brazil. The hacktivist group targeted the club in response to its controversial decision to hire goalkeeper Bruno Fernandes de Souza, who had been released from prison weeks earlier after serving part of a 22-year sentence for the 2010 murder of his ex-girlfriend Eliza Samudio. During the first attack, hackers replaced the site's content with a defacement page featuring the message "Has Bruno told where is Eliza's body?" alongside images referencing the crime. Within hours, a second defacement occurred displaying statistics about femicide in Brazil since 2013, anti-domestic violence messages, and photographs of both Bruno and Samudio. The club acknowledged the compromise through a Twitter post that same day.
The cyber attacks amplified existing public backlash against Bruno's hiring, triggering immediate financial repercussions. Food supplement sponsor Nutrends terminated its sponsorship prior to the hacks due to social media pressure, while medical services provider Cardiocenter Varginha withdrew its sponsorship post-attack, publicly announcing on Facebook that it had requested brand removal from the club's website. Though no technical details about attack vectors or system restoration were disclosed, the incident demonstrated coordinated action between online activists and public sentiment, as social media campaigns urging sponsor boycotts directly contributed to contractual cancellations. The defacements remained publicly visible throughout the attack period, serving as the primary vehicle for conveying the hackers' condemnation of both the club's decision and broader violence against women in Brazil.