Cyberattack Disrupts Portals at 20 Espírito Santo Municipal Institutions; Data Exposure Unconfirmed

Summary

A cyberattack disrupted portals at at least 20 municipal institutions in Espírito Santo. Authorities are investigating suspected access through service provider Ágape; claims of data exfiltration remain unconfirmed.

Key points

• At least 20 municipal institutions in Espírito Santo reportedly had portals or systems affected, including Vila Pavão's city hall and council.
• The BLCKORDER group claimed responsibility through defacement messages and linked the attack to the 2026 elections.
• Officials said the impact was limited to public-facing institutional portals; critical infrastructure, databases, internal networks, and process-management systems were reportedly unaffected.
• Preliminary inquiries suggest credential-management failures or vulnerabilities involving former employees may have enabled access.
• Ágape Consultoria, which provides systems and portal hosting, is identified as a possible entry point; that account remains under investigation.
• Attackers alleged they exfiltrated municipal data, but authorities have not confirmed whether data was accessed or copied, or its nature or extent.
• Police and technical teams are investigating, while affected portals remain unavailable or access-restricted in some municipalities.

MITRE ATT&CK

Threat Actors

Vendors