Cyber Incident Victim: Tribunal de Justiça do Estado do Rio Grande do Sul
Date:
Mar 2025
Location:
Brazil
Summary
The Tribunal de Justiça doEstado do Rio Grande do Sul experienced a cyber attack attempt that led to temporary restriction of external access to its Eproc electronic process system, with access restored later the same day after internal-only operation. The tribunal issued an unavailability notice, deactivated previous links, and directed users to new URLs while noting prior incidents including a hotsite alteration, a ransomware attack that caused data loss and procedural deadline suspensions, and password management failures that leaked police operation information to criminals.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On the afternoon ofWednesday, March 26, 2025, the Tribunal de Justiça do Estado do Rio Grande do Sul detected a cyber‑attack attempt targeting its systems. In response to the threat, the tribunal’s technical team temporarily restricted external access to the Eproc electronic process system. During the restriction, the system remained available only for internal users within the tribunal’s network. The containment measure was implemented to prevent further propagation of the intrusion attempt. Around 23:00 on the same day, the technical team succeeded in restoring external access to Eproc.
Following the identification of the intrusion attempt, the tribunal issued an official certificate of unavailability for the Eproc system dated March 26, 2025. Although external access was later normalized, the links previously used to reach the system were temporarily deactivated. Users were instructed to access the first instance of Eproc via the URL https://eproc1g.tjrs.jus.br/eproc/Baguete. Users were also instructed to access the second instance of Eproc via the URL https://eproc2g.tjrs.jus.br/eproc/. The tribunal noted that this incident was not the first cyber‑security event affecting its systems. In 2020, hackers altered the informational hotsite of Eproc, although the underlying process data and databases were not compromised. The following year, a ransomware attack rendered the tribunal’s systems unavailable, causing data loss and the suspension of procedural deadlines. In 2023, the Ministério Público disclosed failures in password management at the tribunal that resulted in the leakage of information about police operations to criminal actors.