Prefeitura Municipal de Pontal do Paraná

Summary

A cyber attack targeted the system provider for Pontal do Paraná City Hall, causing indefinite downtime of municipal tax services. The incident disrupted all IPTU/2023 issuance and consultation capabilities, affecting both digital and in-person operations. Officials notified taxpayers of the service interruption and pledged updates upon restoration, though no recovery timeline was provided. The outage occurred during a critical tax payment period involving discounts and installment options.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 2, 2023, the Finance and Budget Secretariat of Pontal do Paraná City Hall announced that its IPTU (Urban Property and Territorial Tax) issuance system became unavailable following a cyber attack targeting the third-party company responsible for maintaining the platform. The municipality was formally notified of the incident by the service provider that morning, though the exact timing and nature of the attack were not disclosed. This disruption rendered both online and in-person IPTU/2023 services inoperable, preventing taxpayers from accessing payment portals or obtaining physical copies at municipal offices. The city hall characterized the outage as indefinite, indicating no immediate restoration timeline. Officials publicly acknowledged the incident through a Facebook post directed at residents, framing the interruption as beyond municipal control due to the external provider’s compromised infrastructure. No details regarding attack vectors, threat actors, or data compromise were provided in the announcement.

The incident directly impacted taxpayers seeking to comply with preexisting fiscal deadlines, particularly the October 2, 2022, cutoff for initial payments eligible for a 15% cash discount or installment plan enrollment. While the payment deadline predated the cyber attack, the system outage obstructed residents from finalizing transactions or accessing records during the critical post-deadline administrative period. Municipal operations adapted by suspending all IPTU-related services until further notice, with no alternative processing methods announced. Response actions were limited to public notification via social media and a commitment to update citizens upon service restoration. The city hall did not disclose whether law enforcement or cybersecurity agencies were engaged to investigate the attack or support recovery efforts. Financial repercussions for taxpayers facing potential late penalties due to the disruption were not addressed in the initial communication.

Sources

Sources available to members: 1 source.