The state health secretariat of Mato Grosso, Brazil (Secretaria de Estado de Saúde de Mato Grosso, SES-MT) detected a cyberattack on Sunday, November 1, 2026, and suspended systems at its linked units while it ran security checks. In a notice issued on November 2, the secretariat confirmed the attack and called it the second cyber incident against its technology infrastructure this year. Days later The Gentlemen ransomware group added SES-MT to its leak site. The secretariat has not named an attacker, has not mentioned ransomware or a ransom demand, and has not said whether any data was taken. HIFY Radar describes SES-MT as the health authority for 141 municipalities and about 3.6 million residents. It runs state hospitals, laboratories, blood centers and a free medication program.
What Happened
Brazilian regional outlets, including Primeira Página, H1MT, Vera News and Fatos de Mato Grosso, carried the secretariat's November 2 statement. According to that statement:
- The attack was detected on November 1. Systems at the units linked to the secretariat were taken offline as a precaution.
- Technical teams are investigating and will restore systems gradually. No timeline for full restoration has been given.
- Essential services, including urgent and emergency regulation and hospital care, kept running, though some units had limited network access.
Fatos de Mato Grosso points out that the notice does not say which systems were hit, whether patient data was accessed, whether there was a ransom demand, or whether the police and Brazil's data protection authority (ANPD) have been told. Primeira Página reports that the secretariat has given no information on possible data exposure and has not identified who was responsible.
The leak-site claim. IntelFusions says The Gentlemen posted the listing on November 5. The entry describes a Cuiabá-based state health secretariat and names facilities including the Julio Müller General Hospital, the Tropical Diseases Hospital and the LACEN state laboratory. HIFY Radar dates the listing to November 2, the same day the secretariat issued its notice. CiberLATAM, writing on November 5, cites an unnamed monitoring service that reported the listing. The reported posting dates differ, and we could not settle which is correct. Either way, the claim came within a few days of the detected attack. The state has made no public statement linking the two.
The March incident. The secretariat was attacked earlier this year as well. That intrusion was found in March and only disclosed in June. At the time SES-MT said it did not pay a ransom, that the affected files had been recovered through contingency and redundancy systems, and that its main database was not compromised. It filed a report with the Civil Police's specialised cybercrime unit (DRCI) and notified the ANPD. Fatos de Mato Grosso reports that containment was carried out with the state IT company, MTI. Vera News says the police inquiry is under seal and that the case also came before the Mato Grosso Legislative Assembly's health inquiry committee (CPI da Saúde).
What Was Taken
For the November incident, nothing has been confirmed. The Gentlemen's listing does not include a data volume, a description of the stolen data or sample files, according to HIFY Radar and CiberLATAM. A leak-site entry is the group's own claim. On its own it does not prove the group carried out the attack or that it holds any data.
For the March incident, reports differ on how much data was involved:
- Primeira Página and H1MT report that the attack hit about 1 TB of files, roughly 6.5 million pages of documents.
- Vera News and Fatos de Mato Grosso, quoting the secretariat's June clarification, put it at less than 1 TB of the total stored volume.
Fatos de Mato Grosso reports that the attackers demanded payment to return the data. CiberLATAM cites media reports that the attacker used LockBit and asked for US$500,000 in bitcoin, and notes that this has not been officially confirmed. Vera News also reports the LockBit link, based on press coverage at the time. HIFY Radar calls the March attack "confirmed" and says local reporting tied it to LockBit. SES-MT has confirmed that the March attack happened. It has not confirmed who was behind it.
A state health secretariat with hospitals, laboratories and blood centers is likely to hold patient records, lab results and procurement data. None of that has been confirmed as stolen in either incident.
Why It Matters
Two incidents in one year at the same agency. HIFY Radar suggests two explanations for a second hit within eight months: a new intrusion, or access left behind after March that was never fully removed. The secretariat said in June that its database was intact. Even so, any agency hit twice in quick succession should assume the first intrusion may not have been fully cleaned up until a forensic review shows otherwise.
Healthcare uptime is under pressure. Emergency regulation kept working, but with limited network access. Gradual, unit-by-unit restoration with no stated end date points to a long recovery across a statewide network.
More Brazilian government bodies on leak sites. IntelFusions reports that Rhysida listed the Minas Gerais state court (Tribunal de Justiça do Estado de Minas Gerais) on November 7. The court has made no public statement and the claim is unverified. IntelFusions says that makes two Brazilian government victims in one week. In its tracking of the previous twelve weeks, no week had more than one.
Disclosure gaps. The March attack took about three months to become public. The November notice did not say whether the ANPD or the police had been told. Under Brazil's data protection law (LGPD), patients and partner organisations depend on those notifications to judge their own exposure.
The Attack Technique
The initial access method has not been disclosed for either incident. SES-MT has not published technical details or indicators of compromise, and The Gentlemen has not described how it got in. The secretariat's statement shows only that the response was to suspend systems across linked units, which suggests the compromise was not limited to one isolated system.
Whether the November attack used ransomware encryption, data theft only, or both has not been confirmed. The March attack was described as having destroyed or locked files that were later restored from backups, the typical pattern of ransomware with encryption. The LockBit link for March has been reported by the press but not confirmed officially.
What Organizations Should Do
- After any incident, hunt for leftover access. Before declaring an intrusion contained, check for persistence: new or changed accounts, remote access tools, scheduled tasks, VPN credentials and service accounts. Rotate privileged credentials across the whole environment, not only on the systems that were hit.
- Review connections with SES-MT. Municipal health departments, suppliers, laboratories and the state IT company that exchange data with or connect to SES-MT should audit those links, rotate any shared credentials, and watch for unusual activity coming from SES-MT addresses.
- Separate clinical operations from administrative networks. Emergency regulation kept running here, but with limits. Health bodies should check that critical patient-care systems can work, or fall back to manual processes, while back-office networks are offline.
- Test backups for both kinds of attack. In March the secretariat said contingency and redundancy systems recovered its files. That covers encryption. It does not help if data has been copied out. Keep offline, immutable backups and pair them with monitoring for large outbound transfers.
- Watch The Gentlemen's leak site. Partners and patients' representatives should watch for any data published under the SES-MT listing and be ready to respond if their records appear.
- Disclose quickly and fully. Agencies should state promptly whether regulators and police have been notified and what data categories may be involved. A three-month gap like the one after March leaves affected people unable to protect themselves.
Sources: Brazilian state health agency hit, then named on leak site | Mato Grosso Health Department Hit Again in 2026 — CiberLATAM | SES-MT sofre nova ofensiva contra sistemas menos de um ano após ata... | The Gentlemen claims attack on Mato Grosso… HIFY Radar | Ataque hacker atinge Secretaria de Saúde de Mato Grosso e provoca s... | Segundo ataque hacker em 2026 paralisa sistemas da Secretaria de Sa... | Mato Grosso: nuevo ataque a Salud estatal — CiberLATAM | Saúde de MT sofre segundo ataque hacker do ano e suspende sistemas...