On Sunday, November 1, the state health secretariat of Mato Grosso (SES-MT) detected what it called a new hacker attack and took the systems at its units offline for security checks. Four days later, The Gentlemen ransomware crew put a Cuiabá-based state health secretariat on its leak site, with a profile that names its hospitals, laboratories and blood centers.
The secretariat has not named an attacker, and the leak-site entry is a claim posted by the crew itself, not proof that it was behind the incident or that data was taken. But the timing is close, and it lands in a week when Brazilian government bodies appeared on leak sites more often than at any point in the past three months.
The state confirmed an attack, not who did it
In a notice published by the Mato Grosso government on November 2, SES-MT said its technical teams were investigating and would restore systems gradually. Essential services, including emergency regulation and hospital care, kept running, though with some limits on network access. The notice describes the incident as a new attack, and it does not mention ransomware, a ransom demand or any group.
The Gentlemen's listing went up on November 5. It describes a secretariat headquartered in Cuiabá, the Mato Grosso state capital, and lists facilities including the Julio Müller General Hospital, the Tropical Diseases Hospital and the LACEN state laboratory. As of this writing we have seen no statement from the state linking the two.
Two state bodies in one week
Two days later, on November 7, Rhysida listed the Tribunal de Justiça do Estado de Minas Gerais, the state court of Minas Gerais. The entry carries nothing beyond the name and a government tag, and we found no public statement from the court about an incident. Treat it as an unverified claim.
That makes two Brazilian government victims in a single week. In the twelve weeks before it, IntelFusions incident tracking never recorded more than one in any week. Earlier government listings came from a handful of crews, among them Emperador, which claimed the federal tax agency, Receita Federal, in September.
A rebound after two quiet weeks
Eight Brazilian organizations appeared on leak sites this week (a ninth entry tagged to Brazil is an Indonesian telecom firm, mis-tagged by the leak site). That follows two weeks with just one claim each, but it is not a surge. Brazil averaged about six a week over the prior twelve weeks, and the October 12 week reached 17, as we noted when Brazil logged its busiest month on leak sites.
The private-sector names are mixed. The Gentlemen also listed Solutis Tecnologias, a São Paulo IT integrator its listing credits with over 1,200 employees, and the real estate agency Coemi Imóveis. Destello, a crew we first recorded on November 5, posted MAPFRE Brasil as its only listing so far. Qilin listed the healthcare firm Roxfarma, MedusaLocker a plastics maker, and Aoqin, another newcomer, a company called Sistel. None of these organizations has confirmed a breach in anything we have seen.
The Gentlemen is the thread. Of its 872 claims in our data since March, 27 are Brazilian, and three of those are public bodies: the municipal chamber of Serra in July, a federal intranet portal in August, and now the health secretariat.
Suppliers to SES-MT should check in now
Brazil is rated a high-targeting country on its IntelFusions country profile, and CERT.br is its national CERT. Hospitals, laboratories and municipal health offices that exchange data or share network links with SES-MT should ask the secretariat directly what was affected and rotate any shared credentials. With no published indicators for either the Mato Grosso or Minas Gerais incident, the defenses that matter are the usual ones: patched internet-facing systems, multi-factor authentication on every remote access path, and offline, tested backups.
A leak-site week is a signal, not a census. A state health system already running on limited network access, and a crew that keeps returning to Brazilian public bodies, is a better reason for the country's public sector to assume it is on more than one list.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.