Brazilian Ministry of Health Listed by lapsus$ Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The Brazilian Ministry of Health Listed by lapsus$ Ransomware Group (reported December 10, 2021) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
What happened
The Brazilian Ministry of Health was listed on the lapsus$ ransomware leak site on December 10, 2021. The group claims to have stolen internal data from the ministry. No further details on the timing of the intrusion, the method of access, or the volume of material have been made public. The number of people affected is recorded as unknown.
Inside lapsus$
Lapsus$ is a ransomware group that has conducted operations against large organisations in multiple countries. Public reporting has described the group’s practice of exfiltrating data before encryption and then posting samples or directories on a dedicated leak site to pressure victims. The group has been linked to earlier incidents involving technology firms, telecommunications providers and other government entities. Its listings are presented by the group as evidence of successful theft; independent confirmation of the data’s authenticity or scope is not always available at the time of posting.
Who is Brazilian Ministry of Health?
The Brazilian Ministry of Health is the federal agency responsible for national health policy, disease surveillance, vaccination programmes and the administration of public health services. It maintains systems that process citizen records related to medical treatment, laboratory results and health programme participation. Because these systems serve a population of more than 200 million, they necessarily hold large quantities of personal and administrative information.
What data was at risk
The only information released states that internal files were exfiltrated. The exact categories of data contained in those files have not been disclosed. Organisations of this type routinely store personal identifiers, health records, administrative correspondence and operational documents. Without a published inventory, it is not possible to confirm which of these categories, if any, were taken in this case.
What's at stake
Exposure of internal government files can create privacy risks for individuals whose records are involved, including potential misuse of health or identity information. For the ministry, the incident may complicate ongoing operations and require additional resources for investigation and remediation. At present, the scale of any such effects remains unquantified because the contents of the claimed exfiltration have not been verified publicly.
If your data was in this claimed breach
Individuals concerned about possible exposure should monitor official communications from Brazilian health authorities for any guidance on affected services. Practical steps include reviewing bank and government account statements for unusual activity and enabling multi-factor authentication where available. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
FR Ministry of Agriculture Listed by lapsus$ Ransomware GroupAYA BANK Listed by lapsus$ Ransomware GroupGITHUB INTERNAL Listed by lapsus$ Ransomware GroupIngka Group (IKEA) Targeted in Alleged Lapsus$ Data TheftLatest breaches
Publicly posted by lapsus — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.