The extortion group Emperador has added Receita Federal do Brasil, Brazil's federal tax and customs authority, to its data-leak site. The listing appeared on 23 September 2026 and claims the group took 6.3 GB of data. According to the post, that includes "several thousand documents with personnel and customer data, as well as all user data on gov.br with passwords." No one outside the group has confirmed this. IntelFusions found no public statement from Receita Federal when it reported on the listing on 26 September. Since then the agency's news and official notices pages have stayed silent: they carry routine updates up to 9 November but nothing about a breach or any denial. No regulator filing or national CERT advisory has been published. This brief treats the incident as an unverified claim made by the people trying to extort the victim.
What Happened
The ransomware tracker ransomware.live recorded the listing on 23 September 2026, according to IntelFusions. Siberpol's write-up gives the same date for the announcement and says the group claims the breach happened that day too. Siberpol calls Emperador a ransomware group. IntelFusions uses the term "extortion crew". Neither outlet reports that any Receita Federal system was encrypted, and no public report links a service outage to the claim. The agency did post notices on 1 and 2 September about unexpected blocks on access to "Meu Imposto de Renda" for users holding power of attorney for companies. Those notices came three weeks before the listing, and the agency gave no sign that a security incident caused them. Nothing connects the two.
Emperador is new. IntelFusions says the group's leak site went live in mid-August 2026 and had posted 27 claims across all countries by late September. Receita Federal is the third Brazilian public body it has named. The first was the Prefeitura Municipal de Arcos, a municipality in Minas Gerais, on 18 August. The second was an entry labelled "Cassias MG Government" on 19 September.
A different, unrelated claim followed. On 5 October, Darkwiser reported that an actor calling themselves "Synq1xxs" had posted on a dark web forum offering 70 million company registration records said to come from Receita Federal. The post included sample records and links to a Telegram channel. Darkwiser marks the claim as unverified. Nothing currently links Synq1xxs to Emperador, and the two claims describe different kinds of data.
What Was Taken
Every detail below comes from the attackers' own claims.
Emperador's claim: - Total volume of 6.3 GB, described mostly as documents (IntelFusions) - Records on staff and on "customers", meaning taxpayers (Siberpol, IntelFusions) - "All user data on gov.br with passwords." gov.br is the federal government's single sign-on portal, used by most of Brazil's adult population.
Synq1xxs's claim (separate actor and dataset): - About 70 million company registration records, according to Darkwiser - Fields listed: legal name, trade name, share capital, CNAE economic activity code, registration status, whether the company opted into Simples Nacional or MEI, and the date it started operating
The two claims do not describe the same data, so their figures cannot be compared as a range. Emperador gave no record count. Synq1xxs's 70 million figure applies only to company registrations. Much of that kind of company registry data is already published by Receita Federal as open data. A dump of those fields would therefore have limited new value unless it holds fields that are not public.
IntelFusions thinks the gov.br part of Emperador's claim is unlikely on the group's own numbers. A login system covering a national population would be a very large dataset, and 6.3 GB, "most of it described as documents", does not look like it. The post offers no sample, record count or technical detail that would let outsiders test the gov.br claim. On current evidence, a limited set of internal documents with staff and taxpayer details is more plausible than a full copy of gov.br credentials. Even that has not been confirmed.
Why It Matters
Brazil has a pattern of claims followed by official denials. UNIQ Security describes a cycle that keeps repeating. Earlier in 2026, a group claimed about 279 million CPF records taken from what it called a live system, and offered the 69.6 GB set for up to US$10,000. Receita Federal denied its systems were compromised and said the data came from an old database tied to a 2019 incident at Ancine, the national film agency. In April another group advertised 251 million CPFs linked to gov.br. In 2021, a leak of data on 223 million Brazilians covered almost the whole adult population. UNIQ's point holds here too: recycled data still does damage. A 2019 dataset in circulation in 2026 still contains names, CPF numbers, parents' names and addresses of people who can be defrauded today.
Insider access is a proven weak point at this agency. In February 2026, Brazil's Federal Police executed four search warrants in São Paulo, Rio de Janeiro and Bahia, according to Tribuna União and Camaçari Notícias. The targets were Receita Federal employees suspected of looking up and leaking confidential tax data on Supreme Court (STF) justices and their families. Justice Alexandre de Moraes ordered electronic ankle monitors, suspension from public duties and cancelled passports for the suspects. Receita Federal publicly admitted that some access to the justices' tax records had been improper and said an internal audit was under way. An auditor in São Paulo was later removed from his post, and police carried out a further operation in Rio de Janeiro on 25 February. None of this proves Emperador's claim. It does show that sensitive taxpayer data at the agency has left through legitimate staff accounts before.
The claim is a phishing opportunity whether or not it is true. IntelFusions warns that a public claim naming gov.br invites phishing campaigns posing as a gov.br "security reset". Leaked staff records from a tax authority would also help fraudsters impersonate tax officials in convincing messages to taxpayers and companies.
The Attack Technique
No one has said how access was gained, if it was gained at all. Emperador has not described an intrusion method, and neither the agency nor any Brazilian authority has reported anything. Siberpol describes the usual double extortion model, where attackers encrypt systems and also steal data to threaten its release. No report shows that encryption happened here, and the claim reads as data theft and extortion only.
Based on the agency's history and the data described, plausible routes include: - Misuse of insider or stolen staff credentials. This has already happened at Receita Federal in 2026, as the Federal Police investigation shows. - Compromise of a contractor or partner system. Receita Federal relies on the federal IT provider Serpro for core services, as its own 2025 notice about an outage in its tax payment document system shows. - Repackaging of old or public data. This matches the Ancine pattern UNIQ Security describes and the open-data nature of the company registry fields Synq1xxs is offering.
These are hypotheses for defenders to test. None is a finding.
What Organizations Should Do
- Treat gov.br-themed messages as hostile. Warn staff and customers that unsolicited emails, SMS or WhatsApp messages about gov.br password resets, account checks or tax debts are likely phishing. Tell them to sign in only by typing the gov.br address themselves.
- Check whether staff reuse their gov.br passwords. If the gov.br part of the claim is even partly true, those passwords will be tried against corporate systems. Run checks for leaked credentials and enforce phishing-resistant MFA, especially on VPN, email and finance systems.
- Lock down the financial and tax workflows that tax-authority impersonators target. Require verification through a second, known channel for any request to change bank details, pay tax debts or share CNPJ or CPF documents.
- Review insider access to sensitive records. Organisations holding citizen or customer records should audit who looked up what, alert on lookups with no business reason, and remove access that is no longer needed. The STF case shows how far authorised users can go.
- Monitor for your own data in circulation. Track leak sites and forums for your company name and CNPJ. The Synq1xxs listing shows that registry data is being traded, and that data helps build convincing supplier and invoice fraud.
- Wait for verification before acting on the full claim. Follow Receita Federal's official notices and any statement from the Brazilian data protection authority (ANPD) or national CERT before treating the gov.br claim as confirmed. Do not download or handle files claimed to be leaked.
Sources: Emperador claims data leak involving Receita Federal do Brasil | Brazil's tax agency appears on a young crew's leak site | Receita Federal do Brasil Company Registration Records Exposed on D... | Operação da Polícia Federal investiga vazamento de dados de ministr... | Camaçari Noticias | Notícias da Receita Federal — Receita Federal | Vazamento de CPF virou rotina no Brasil — negar não é a mesma coisa... | Comunicados — Receita Federal