Brazil: Arcos in Emperador’s claim

The Emperador group has claimed a cyberattack against the Prefeitura Municipal de Arcos in Brazil, saying it exfiltrated sensitive data and encrypted critical systems. Breach-monitoring and ransomware-tracking platforms list it as an alleged target, but there is still no public confirmation from the municipality or independent verification of the incident.

What is known about the claim against Arcos?

According to the source that circulated the claim, Emperador said it gained full access to the municipality’s internal infrastructure and extracted sensitive information. The material reviewed also says the group threatened to publish the data if its demands are not met.

Ransomware.live listed the Prefeitura Municipal de Arcos as a supposed target, with an estimated discovery and attack date of August 18, 2026. That record attributes a data volume of roughly 462.3 MB and sets a 14-day deadline for publishing the exfiltrated information if there is no response.

What do the threat intel platforms indicate?

The platforms cited agree that the case remains without official confirmation and, for now, is an unverified leak claim. GalaxyWarden and RecentBreaches describe access to servers, databases, emails, and administrative credentials, along with encryption of critical systems.

FalconFeeds and H4ckmanac also list Prefeitura Municipal de Arcos as a victim attributed to Emperador, with an alleged exposure of about 0.46 GB, within the Government sector, and the incident marked as pending verification. DisclosureLens, meanwhile, classifies the case as an unverified leak claim originating on a leak site, with a first filing on August 18, 2026.

What is still missing to confirm the real scope?

No technical details have been released yet about the intrusion vector, the affected infrastructure, the type of stolen data, or the concrete operational impact. UNDERCODE NEWS placed the case within a broader wave of ransomware groups claiming new public-sector targets, but did not add further technical specifics.

The Arcos case adds to another ransomware-attributed offensive in the region. In Colombia, international coverage of the attack on the Ministry of Justice and Law reported file encryption, service disruption, and damage to processes tied to illicit-drug monitoring and legal procedures. Authorities, however, say no data theft was identified in that incident.

Colombian media added that a forensic review is still underway at the Ministry of Justice to determine the real scope of the attack, and that so far only partial impact on the technology infrastructure is known, with no final public tally of the damage.