Brazil expands cyber drill across transport

Update October 7, 2026: The Guardião Cibernético 8.0 exercise had a broader scope than initially reported, with simultaneous activity in Brasília and hubs in Belém, Manaus, Recife, São Paulo, Rio de Janeiro and Curitiba. Nuclear-sector agencies also joined, and the range of tested areas expanded.

Brazil took the Guardião Cibernético 8.0 exercise to Brasília and to hubs in Belém, Manaus, Recife, São Paulo, Rio de Janeiro and Curitiba, with about 1,300 to 1,400 participants from 300 organizations and representatives from 14 countries. The simulation, led by the Brazilian Army through ComDCiber, tested responses to threats against critical infrastructure and widened its focus beyond transport and energy.

What did Guardião Cibernético 8.0 show?

IEC presented the exercise as the largest cyber simulation in the Southern Hemisphere. According to official sources, institutions tested prevention, detection, response, crisis management, recovery and continuity of essential services.

Edition 8.0 brought together public and private organizations from 14 countries, with about 1,400 participants according to Agência Gov and close to 1,300 according to the Instituto Evandro Chagas. That difference does not change the overall picture of the drill, which relied on a broad network of actors to rehearse incidents affecting the country’s critical infrastructure.

Which sectors took part?

The simulations included energy, transport, water resources and communications, and also added the economy, biosecurity and bioprotection. IPCN, IEC and other participating institutions placed the exercise within an agenda aimed at covering essential services and sensitive areas that were not mentioned in the original coverage.

In that same context, IPEN said it took part and explained that the national drill was used to test prevention, detection, response, crisis management and recovery against cyberattacks and incidents targeting critical organizations and infrastructure. The presence of the nuclear sector broadened the scope beyond the original report, which focused on transport, energy and essential services.

What precedent was there in transport?

In Brazil, recent coverage of cybersecurity has centered on readiness and operational risk rather than confirmed incidents. The most concrete precedent in the material is the ransomware attack that hit Braspress in July 2024, when operational systems were compromised and the company had to take environments offline while it gradually restored operations.

What did the Braspress case show?

The Braspress case offered a clear example of operational impact in the transport sector. According to Valor, the July 2024 attack affected the company’s operational systems and forced a phased recovery, with environments kept offline as restoration moved forward.

That episode now appears as part of a broader discussion about the role cybersecurity plays in Brazil’s transport strategy. Valor said the issue gained space because of the operational risks it can create in a sector where service continuity is critical.

What changed in the electric sector?

In Brazil’s power sector, the most visible focus is not a specific incident but a regulatory requirement. An AGÊNCIA DINO report published by Revista PEGN said Portaria No. 126/2026 requires cybersecurity and interoperability mechanisms.

The same sector coverage linked that framework to the challenges created by smart metering. The core point, according to that report, is that grid modernization comes with new technical obligations meant to reduce risk and ensure compatibility between systems.

What role do critical infrastructure exercises play?

The Guardião Cibernético 8.0 simulations brought together critical areas including energy, transport, water resources and communications. IEC’s institutional note, published by gov.br, shows that the official focus is on coordination exercises for essential infrastructure.

That kind of preparation fits the rest of the available material. On one side is operational pressure in transport, with the Braspress case as precedent. On the other, the power sector is taking on formal cybersecurity and interoperability requirements, while state exercises rehearse responses for services that cannot stop.

What did ANEEL say about Enel SP?

ANEEL dealt with a matter tied to extreme weather events that affected Enel Distribuição São Paulo, although the note does not describe a cybersecurity incident. The agency denied Enel SP’s appeal against a decision that had rejected a technical expert review related to those events.

That fact is not a cyber case, but it does form part of the regulatory and operational context surrounding Brazil’s critical infrastructure. In the material, the dominant reading is that cybersecurity, service continuity, technical requirements and preparedness for disruptions are now being discussed together more than confirmed attack after confirmed attack.