Cyber Incident Victim: Cadastro Nacional da Pessoa Jurídica
Date:
Jan 2021
Location:
Brazil
Summary
A hacker suspected of orchestrating Brazil's largest data breach was arrested by Federal Police in Operation Deepwater, which targeted the illicit acquisition and sale of sensitive personal and corporate information. The compromised data included taxpayer registry numbers (CPF and CNPJ), full names, and addresses affecting hundreds of millions of individuals. The primary suspect, operating under the alias "Vanda the God," was identified as a 24-year-old individual whose equipment was seized, while a second actor known as "JustBR" allegedly marketed the stolen records on cybercrime forums. Authorities executed multiple warrants in connection with the widespread dissemination of confidential records.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
In January 2021, confidential data belonging to Brazilian individuals and companies was illicitly disclosed and commercialized online. The compromised information included sensitive identifiers such as Individual Taxpayer Registry (CPF) numbers, Corporate Taxpayer Registry (CNPJ) numbers, full names, and physical addresses. Federal Police investigations determined this constituted the largest data leak in Brazil’s history, impacting millions of citizens and multiple government authorities. The threat actor known as "Vanda the God" was identified as a primary suspect in obtaining and disseminating the data. A second individual using the alias "JustBR" subsequently listed portions of the stolen information for sale on RaidForums, a cybercrime forum. The scale of the breach drew significant law enforcement attention due to the exposure of critical personal and corporate identifiers essential for financial and administrative transactions across Brazil.
On March 19, 2021, the Federal Police arrested 24-year-old Marcos Roberto Correia da Silva—allegedly "Vanda the God"—in Uberlândia, Minas Gerais, as part of Operation Deepwater. Authorities executed search warrants, seizing his computer and mobile phone as evidence. The operation targeted the unlawful acquisition, distribution, and monetization of Brazilian citizens’ data, with additional arrest warrants issued for other suspects. Investigations revealed the leaked dataset encompassed records of approximately 223 million Brazilians, indicating near-total national coverage. The arrest highlighted coordinated efforts to address high-profile cybercrimes involving mass data exfiltration, though the specific methods of initial access and full extent of commercial exploitation remained under investigation. Federal Police confirmed the operation was ongoing, with further forensic analysis of seized devices underway to identify additional perpetrators and compromised systems.