The Rhysida ransomware gang has added the Tribunal de Justiça do Estado de Minas Gerais (TJMG) to its dark-web leak site. TJMG is the court system of Brazil's second most populous state. Rhysida says it got into the court's network, stole data and is now demanding payment. So far the only evidence is the gang's own listing. The court has not confirmed an incident. No Brazilian regulator or national CERT has said anything public, and no established security outlet has reported on it. Threat-tracking sites say the listing appeared on 7 November 2026. They also say the gang has not stated how much data it took or how much money it wants.
What Happened
Ransomware.live, which tracks leak-site posts, indexed the listing at 13:16 UTC on 7 November 2026, according to QPulse. That site gives 7 November as the estimated attack date. Cybrmonk also reports the alleged attack date as 7 November. Yazoul says the post went up "on or around" that day. Some trackers set the attack date to the posting date when they have nothing better, so the date may only mean when the listing appeared, not when anyone broke in.
All three trackers describe the claim the same way: data stolen, held for ransom, under the "Government & Defense" sector. None of them says it has seen data samples, file listings or other proof. Yazoul says plainly that it has reviewed no proof-of-compromise material. Cybrmonk says the court has not confirmed anything. QPulse says the listing gives no detail on how the attackers got in, what data was taken, or whether the court's systems are still running.
Being named on a leak site does not prove a breach happened. Ransomware gangs sometimes exaggerate, recycle old data or list victims to put pressure on them. Until TJMG, Brazil's data protection agency (ANPD) or an independent researcher confirms it, readers should treat this as a credible claim that has not been verified.
The listing comes during a busy few weeks for cybercrime in Brazil and in Minas Gerais itself. None of these cases has been linked to Rhysida or to the court:
- On 5 November, CNN Brasil and G1 reported that the Fundo Garantidor de Créditos (FGC) had disclosed unauthorised access to customers' names, CPF taxpayer numbers, email addresses, dates of birth and payment-related tax details. The access was found on 26 October, and the FGC has told the ANPD.
- On 6 November, A Gazeta RM reported that the municipality of Alagoa, in southern Minas Gerais, had money taken illegally from its accounts at Caixa Econômica Federal. Civil Police have opened an investigation and the Federal Police have been told.
- On 28 October, O Tempo reported that Belo Horizonte police had arrested nine people. The group allegedly used leaked INSS and bank data to defraud retirees of about R$300,000.
What Was Taken
Nobody outside the gang knows yet. Yazoul reports that the amount of stolen data is listed as "undisclosed." No tracker describes the types of files. No samples are known to have been published.
If the claim is true, the possible exposure is serious. A state court system typically holds case files, including sealed and family-court matters. It also holds personal data on defendants, victims and witnesses, internal judicial correspondence, employee and payroll records, and documents from lawyers and the public prosecutor. In Brazil, much of that data carries CPF numbers. The recent FGC and INSS cases show that criminals in the region actively use CPF-linked records for identity fraud and for scams targeting older people. Court data could make that kind of fraud easier and more convincing.
Why It Matters
The victim is a major government body. TJMG is among Brazil's largest state judiciaries. A confirmed breach would affect people involved in court cases across the state. It could also damage trust in the electronic case-filing systems that Brazilian courts rely on.
Rhysida's record. Data recovery firm Proven Data counts 311 victims publicly claimed by Rhysida as of 2 November 2026, 17 of them in the previous 30 days, across 42 countries. By its figures, education (19%), healthcare (16%) and professional services (15%) are the largest groups, and government is a regular target. The group has operated since May 2023. Proven Data and other researchers link it to the actor cluster tracked as Vanilla Tempest, GOLD VICTOR, STAC5279 and Arcane Mantis, which previously deployed Vice Society ransomware.
Accounts differ on how Rhysida is run. Yazoul says researchers "widely" describe Rhysida as ransomware-as-a-service, where affiliates rent the malware. Proven Data calls the operating model "disputed" and says it may be a private operation. This matters for defenders: the techniques used in an attack can vary much more if many affiliates are involved.
Double extortion. Rhysida steals data before encrypting systems. If the victim does not pay, it auctions or publishes the data. Restoring from backups therefore does not remove the risk that the data leaks.
The Attack Technique
No one has said how anyone may have got into TJMG's network. What follows is Rhysida's general method from past reporting, not findings from this case.
- Initial access: Proven Data lists VPN accounts without multi-factor authentication (MFA), fake signed software installers and "TerminalFix" lures. Yazoul notes that public reporting describes the group entering through stolen credentials and remote-access services.
- Post-compromise tooling: Yazoul reports Cobalt Strike beacons, misuse of built-in Windows administration tools, and lateral movement using stolen credentials.
- Encryption: According to Proven Data, the Windows encryptor uses AES-256-CTR with RSA-4096 and only partly encrypts large files. It targets Windows, Linux and VMware ESXi. Encrypted files get the
.rhysidaextension, and the ransom note is namedCriticalBreachDetected.pdf. - Recovery: Proven Data says a free public decryptor works on early Windows builds but not on every variant. Identifying which build was used is one of the first recovery steps.
Cybrmonk suggests the gang probably used weak patch management or reused credentials. That is a guess, not evidence from this incident.
What Organizations Should Do
- Remove VPN access that has no MFA. List every VPN, remote desktop and remote-access gateway account. Enforce phishing-resistant MFA on all of them, and disable dormant or shared accounts. This is the entry route most often linked to Rhysida.
- Search for Rhysida's known traces. Look for Cobalt Strike beacon traffic, unusual remote PowerShell or PsExec use, files named
CriticalBreachDetected.pdf, and files with the.rhysidaextension. Watch ESXi hosts for unexpected SSH logins or mass virtual machine shutdowns. - Separate case-management systems from public-facing services. Court and government networks should put e-filing portals, public websites and internal judicial databases in separate network segments, with strict controls between them.
- Watch for large outbound transfers. Since Rhysida steals data before encrypting, alert on unusual uploads to cloud storage, file-transfer tools or unfamiliar destinations. This is especially important outside business hours.
- Keep offline, immutable backups and test them. Store backups where domain administrator credentials cannot reach them, including ESXi snapshots and configuration. Practise restoring them. If you are hit, keep the affected hosts for forensic work before you wipe them, because that evidence shows what data was taken.
- Plan your LGPD response now. Brazilian public bodies should have a process ready for notifying the ANPD and affected people under the LGPD, Brazil's data protection law. Anyone whose data a court may hold should expect phishing and fraud that uses CPF-linked details. Treat unexpected calls or messages that cite court cases with suspicion.
Sources: Rhysida claims to have hit Brazil’s Minas Gerais State Court in all... | Minas Gerais Court Ransomware Claim by Rhysida (Nov 2026) | Rhysida Ransomware Group Claims Attack on Tribunal de Justica do Es... | Prefeitura de Alagoa, MG comunica ataque cibernético e retirada ile... | FGC comunica vazamento de dados pessoais de clientes, incluindo CPF... | FGC sofre invasão que expõe nomes, CPFs e outros dados pessoais de... | Grupo que aplicava golpe em idosos usava dados vazados | Rhysida Ransomware: Attack Chain, IOCs, and Recovery Options