A threat actor calling itself S3roqu3l claims to have compromised the Civil Police of Pará (Polícia Civil do Pará) in northern Brazil and exfiltrated roughly 2.5 terabytes of data, including investigative material, internal email, personnel records, LDAP directory contents and active session tokens. The claim surfaced through open-source CTI monitoring channels and was reported on 4 September 2026 by Imago, which states plainly that the incident has not been officially confirmed by Brazilian authorities. Readers should weight that caveat heavily: the entire Pará claim currently rests on a single non-primary report relaying the attacker's own assertions. No victim statement, no ANPD or federal notification, and no independent vendor or CERT corroboration has been published at the time of writing. What follows treats the actor's claims as claims, and reads them against three comparable, better-documented 2026 incidents in which attacker figures and reality diverged.
What Happened
According to Imago, S3roqu3l issued an alert through open-source cyber threat intelligence channels asserting that it had infiltrated the Civil Police of Pará's network and gained access to 2.5 TB of highly sensitive material spanning police intelligence, internal communications and access credentials. The report attributes the initial dissemination to threat-monitoring sources rather than to a leak-site posting reviewed first-hand, and it does not describe sample data, a ransom demand, a deadline, or a named dark web listing. That is a materially thinner evidentiary base than the equivalent reporting on this year's UK Police National Legal Database (PNLD) incident, where the actor published samples and the victim eventually issued its own notice.
The distinction matters because 2026 has already produced a cautionary case. When the ExfilSquad brand claimed the PNLD breach, CTI Pilot noted the group was a five-day-old extortion brand whose other fourteen claims appeared fabricated. The PNLD claim happened to be real, and PNLD, operated by West Yorkshire Police, confirmed it on 3 August 2026. But the base rate for a new, unproven brand's claims in that same reporting was poor. S3roqu3l is likewise not an established name with a track record of verified victims, and the Pará claim should be held in that same provisional category until Brazilian authorities speak or samples are independently validated.
Pará's operational profile is what makes the claim credible enough to act on regardless. The state covers a vast territory in northern Brazil and sits at the centre of federal and state efforts against organised crime and drug trafficking, which makes its Civil Police a high-value target for criminal groups seeking counter-intelligence on investigations against them, not merely for financially motivated extortion crews.
What Was Taken
The claimed haul, per Imago, breaks into four categories:
Email exfiltration. Internal communications that could reveal ongoing operations, tactical planning and personal data belonging to serving officers.
LDAP directory exposure. Compromise of the directory service underpinning authentication across the network, implying attacker visibility into account structures and credentials for internal systems.
Active session tokens. Imago characterises these as master keys allowing impersonation of legitimate users without passwords, enabling lateral movement and further collection.
Police intelligence material. The category the report flags as most concerning, and the one with the most direct physical-safety consequences.
On volume, the only figure in circulation is the actor's own 2.5 TB claim, carried by Imago. There is no second, independent estimate to range it against, and no victim-side counter-figure. History argues for scepticism about attacker-stated volumes. In the PNLD case the numbers moved in both directions and never converged cleanly: ExfilSquad claimed roughly 135,000 records and 1.9 GB of data (eSecurity Planet, citing BleepingComputer for the sample publication); PNLD's own notice described the exposed fields and gave no victim total at all; The Hacker News noted PNLD reported 108,429 police registrations across all 43 Home Office forces in its 2025-26 annual summary, explicitly a user-base figure and not a breach-victim count; and Information & Data Manager described the exposure as covering "more than 100,000" police and criminal justice staff. CTI Pilot's update flagged the 135,000 figure as third-party reporting that required correction. Separately, when a 1 TB darknet claim was made against Bank of Baroda, the bank told the Economic Times the incident stemmed from the compromise of a single employee's email account and that core banking systems were never accessed. Attacker-stated terabyte counts have repeatedly proven to be an upper bound on staged or duplicated data rather than a measure of unique sensitive records.
What is genuinely different about the Pará claim, if it holds, is the data class. PNLD stressed that it is not the Police National Computer, not the Police National Database, not a crime-recording system, and holds no confidential information on victims, witnesses or offenders. S3roqu3l is claiming precisely the opposite category: investigative files and police intelligence, from a force operating against organised crime.
Why It Matters
A contact directory of police officers is dangerous because it enables convincing phishing and impersonation. Both The Hacker News and eSecurity Planet made that point about PNLD, and Tiff Lynch, chair of the Police Federation, told The Telegraph the breach raised serious concerns about the safety of officers and staff, per eSecurity Planet's reporting. Investigative case material and intelligence products are a different order of harm. If the S3roqu3l claim is accurate, the exposure potentially reaches informant and cooperating-witness identities, undercover officer assignments, surveillance methodology, and the timing of pending operations. Against organised crime and trafficking networks with the money and motive to buy such data, that is a direct threat to life rather than a phishing-enablement problem.
The session-token element deserves specific attention from defenders. Stolen bearer tokens survive password resets and, depending on configuration, survive MFA enforcement, because the authentication event has already occurred. An organisation that responds to a breach claim by forcing a password rotation and calling it contained has not actually evicted an attacker holding valid tokens. Token revocation and session invalidation have to be explicit, deliberate steps.
More broadly, this fits the year's dominant public-sector pattern. The City-Forum campaign documented by BleepingComputer, traced by SaaS security firm Reco to a single Contabo-hosted server at 158.220.87.79 using the default Go-http-client/1.1 user agent, has been harvesting data from Salesforce Experience Cloud and ServiceNow portals worldwide, public-sector portals among them, without exploiting any vulnerability. It simply collects what organisations have exposed to unauthenticated guest users through overly permissive sharing rules. Government bodies are being hit hard not because they face better attackers but because their externally facing platform configurations are weaker.
The Attack Technique
The initial access vector for the Pará incident has not been disclosed by anyone, including the actor as reported. Imago describes what the attackers say they obtained, not how they got in. Any technical narrative beyond that would be invention.
What the surrounding sources do supply is a set of realistic candidate paths, each of which produced a real law enforcement or financial-sector breach in 2026. For PNLD, the technical explanation reported by CPO Magazine and relayed by Information & Data Manager came from Denis Calderone, chief technology officer at Suzu Labs, who said a misconfiguration in a Microsoft Power Pages portal was the root cause: PNLD's Anonymous Users web role had read access to backend Dataverse tables, making the subscriber database queryable through a standard API call by anyone visiting the site without logging in. Calderone drew an explicit analogy to the open S3 bucket era, noting the attacker needed no malware and no exploit. This is a third-party technical assessment, not an official finding. Rescana states directly that the technical root cause has not been officially disclosed and that a misconfiguration of a public-facing application is a likely but unconfirmed explanation, and CTI Pilot's headline makes the same distinction, noting researchers traced the ExfilSquad campaign to anonymously readable Power Pages portals but not to PNLD's own root cause specifically.
The second candidate path is the mundane one. Bank of Baroda attributed its terabyte-scale darknet leak claim to a single compromised employee mailbox, which is a plausible generator of exactly the email-plus-credential mix S3roqu3l describes. The third is the City-Forum model of unauthenticated guest access to SaaS portals. All three are configuration and identity failures rather than exploit chains, which is the practical lesson available here even without knowing what happened in Pará.
One further conflict is worth recording. Rescana notes that while PNLD and several sources state passwords were not affected, one media report cited a source claiming password theft, and that this remains unconfirmed. PNLD's own statement, the primary-weight document, says there is no evidence that passwords or other security credentials were compromised. Where a victim statement and a single unattributed media claim disagree, the victim statement governs, with the discrepancy noted rather than buried.
What Organizations Should Do
Revoke sessions, not just passwords. Where token theft is claimed or suspected, force global session invalidation across identity providers, VPN concentrators, webmail and SaaS tenants, and shorten token lifetimes afterward. Rotate signing keys where the platform supports it. A password reset alone leaves a token-holding attacker fully authenticated.
Audit anonymous and guest access on every public-facing portal. Enumerate what an unauthenticated visitor can actually read through the API, not just through the rendered UI. For Microsoft Power Pages, review Anonymous Users web role table permissions against Dataverse. For Salesforce Experience Cloud and ServiceNow, review guest user sharing rules and object permissions. This single control class accounts for the PNLD root cause as assessed by Suzu Labs and the entire City-Forum campaign.
Hunt for the City-Forum indicators now. Search web and proxy logs for the IP 158.220.87.79 and for bulk data retrieval by the Go-http-client/1.1 user agent, particularly from guest or unauthenticated contexts. Reco reports the campaign is still running and its volume is climbing.
Harden directory services against bulk enumeration. Restrict LDAP query scope by service account, alert on anomalous directory reads, and place tiered administrative accounts behind separate authentication paths so that one directory compromise does not yield the whole credential estate.
Treat officer contact data as targeting data and warn the humans. Brief personnel that verified names, roles and work addresses in attacker hands make phishing and impersonation attempts materially more convincing, as both UK government guidance and the PNLD reporting emphasised. Pair the warning with an out-of-band verification procedure for any unusual request that arrives by email.
Fix the disclosure posture before you need it. PNLD notified the Information Commissioner's Office, engaged the National Crime Agency and specialist cybersecurity firms, contacted affected organisations within days, and published a statement that anchored the public record and corrected inflated third-party figures. Silence, by contrast, is what leaves an attacker's unverified 2.5 TB claim as the only account in circulation, which is precisely the position the Pará story sits in today.
Sources: Brazil Police Cyberattack: Hackers Claim Massive 2.5 TB Data Breach... | Bank of Baroda Data Leak: Compromised employee email linked to alle... | "City-Forum" data-theft attacks target Salesforce, ServiceNow portals | PNLD Breach Exposes U.K. Police and Government Contact Details on D... | PNLD confirms the police contact-data breach and names a second aff... | Hackers Claim They Stole a Directory of 135,000 UK Police Contacts | UK Police Database Leak Hits All 43 Forces Information & Data Manager | PNLD Data Breach Exposes UK Police and Government Contact Informati...