Prefeitura do Jaboatão dos Guararapes listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Brazil
• Sector: Government & Defense
• Announcement date: August 16, 2024

The Brazilian public institution Prefeitura do Jaboatão dos Guararapes has been listed on the leak site of the Qilin ransomware group. The threat actor claims to have successfully breached the institution's systems and exfiltrated a significant volume of data, subsequently posting an announcement on their platform to signal the attack.

The details of the claimed attack

According to the announcement posted on the Qilin leak site on August 16, 2024, the group claims to have breached the systems of the municipality. The threat actors state that they have exfiltrated over 500 GB of data belonging to the organization. To support their claims of a successful intrusion, the group has released a portion of the stolen data as proof of the breach.

The timeline provided by the attackers suggests the initial breach or activity occurred around July 16, 2024, approximately one month before the public announcement on their leak site. While the group has provided visual evidence, the specific nature of the breach remains tied to the group's assertions.

Data involved in the leak

The information released by the Qilin group includes various types of visual evidence to demonstrate the scope of the intrusion. The shared screenshots provided by the attackers display a variety of content, including various tables, graphical data, file directories, and other visual content. However, detailed information regarding the full scope and the specific nature of the data contained within the 500 GB remains unavailable.

• Tables
• Graphical data
• File directories
• Visual content

The listing does not provide a specific ransom demand, and the exact file count remains unknown.

The organization profile

The target of this alleged attack, the Municipality of Jaboatão dos Guararapes, is a local government entity located in the state of Pernambuco, Brazil. This public institution is responsible for managing the city's administrative affairs, public services, and various municipal operations within its jurisdiction.

Implications and sector risks

Given that the institution operates in the public administration sector, the leaked data may potentially contain personal information of citizens. This possibility introduces significant risks, as such data could be used for identity theft or targeted phishing attacks against the population. Furthermore, the publication of sensitive information can increase secondary risks for both the municipality and the individuals involved.

From a regulatory standpoint, a breach of this nature could lead to legal sanctions and administrative processes under Brazil's LGPD regulations. The Qilin group's use of double extortion tactics—whereby data is both encrypted and stolen to be used for leverage—may exert pressure on the institution to pay a ransom. This tactic is a common method used by modern ransomware groups to maximize their impact.

For organizations operating in critical sectors like public services, such incidents highlight the necessity of robust defensive measures. Organizations in this sector typically focus on strengthening their security posture through regular auditing, implementing strict access controls, and maintaining comprehensive data protection frameworks to mitigate the impact of potential exfiltration and extortion attempts.