Banco do Brasil Listed by kelvinsecurity Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 1, 2022, Banco do Brasil was listed on a leak site operated by the kelvinsecurity ransomware group. The listing states that the group obtained internal files from the bank, though the number of individuals affected and any independent confirmation of the data’s contents have not been made public. The incident is significant because Banco do Brasil is a major national financial institution whose systems contain extensive records of customer accounts and transactions.

What happened

The only confirmed public information is the April 1, 2022 listing of Banco do Brasil on the kelvinsecurity ransomware leak site. The group claims to have exfiltrated internal files during a ransomware attack. No details on the date of the intrusion, the method used to gain access, the volume of data, or whether any ransom was demanded or paid have been disclosed. The number of people affected remains unknown.

Who is kelvinsecurity?

kelvinsecurity is a ransomware operator that maintains a public leak site to publish data taken from organizations that do not meet its demands. Groups of this type commonly use double-extortion tactics: they encrypt systems to disrupt operations and separately threaten to release stolen files. Their listings constitute claims made by the group itself and are not independently verified unless confirmed by the victim or law-enforcement authorities.

About Banco do Brasil

Banco do Brasil is one of Brazil’s largest banks, providing retail, corporate, and government banking services across the country. Institutions of this scale routinely process customer account information, loan and credit records, payment histories, and internal operational documents. A successful intrusion at such an organization can therefore involve data that is both financially sensitive and subject to banking-sector regulatory requirements.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No specific categories of data—such as customer names, account numbers, or personal identifiers—have been named. While banks of this type typically hold records that include identification documents, financial transactions, and contact details, the exact contents of the claimed exfiltration are unconfirmed.

Why it matters

Exposure of internal bank files can create opportunities for targeted fraud or account takeover if personal or financial details are involved. For the institution, the incident may trigger regulatory scrutiny and require additional security investment. Individuals cannot yet assess their personal exposure because the scale and nature of the data remain undisclosed.

If your data was in this claimed breach

Monitor bank and credit-card statements for unauthorized activity and enable transaction alerts. Use strong, unique passwords and consider a password manager. Request a credit report from the relevant national bureau to check for new accounts opened without your knowledge. Readers can run a free exposure scan of their email address against known breach data to see whether their information appears in previously published incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.