Cyber Incident Victim: Aeroporto Internacional de São Paulo/Guarulhos
Date:
Mar 2025
Location:
Brazil
Summary
GRU Airport reported that a cyber attackon its official website rendered the page unstable and inaccessible for several hours during the afternoon, though airport operations were unaffected. The operator said it had followed all security protocols and that the site was later restored, although residual instabilities persisted at the time of the statement. A hacker using the alias Azael claimed responsibility, saying the strike was timed for 13:12 and followed a prior breach of the University of São Paulo.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On Saturday, March 15, 2025, a hacker using the alias “Azael” announced a cyberattack against the official website of São Paulo/Guarulhos International Airport (GRU). The announcement was made via a message sent to press outlets, stating that the attack would occur precisely at 13:12 Brasília time. According to the hacker’s message, the attack followed a claimed successful breach of the University of São Paulo (USP) website, which had not yet recovered. GRU Airport, the concessionaire that manages the airport, confirmed to CISO Advisor that its official site (www.gru.com.br) became unstable and went offline shortly after the announced time. The website remained inaccessible for several hours before being restored. The airport operator emphasized that the disruption was limited to the web page and that no operational systems of the airport were affected.
GRU stated that it had activated all of its security protocols in response to the incident. By the time the CISO Advisor note was published, the site was still exhibiting some instability. The company indicated that it continued to monitor the situation and work to fully stabilize the online service. No further details about the attack vector, tools used, or attacker identity beyond the alias were disclosed in the available sources. The hacker’s claim of responsibility linked the GRU incident to the earlier alleged USP breach, suggesting a pattern of targeting Brazilian institutions. Despite the website outage, airport operations, including flights and ground services, continued without interruption according to the operator’s statement. The incident concluded with the website being brought back online, although residual instabilities were noted at the time of reporting.