saude.mt.gov.br Listed by lockbit5 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 17, 2026, the ransomware group lockbit5 listed saude.mt.gov.br on its leak site. The organization is the State Secretariat of Health of Mato Grosso (SES-MT), the primary executive body responsible for state-level health services in Mato Grosso, Brazil. Public information states that internal files were exfiltrated during a ransomware attack, but the number of people affected is not known and no further details on the scope or confirmation of the listing have been released.

Inside the incident

The only confirmed public detail is the listing itself on June 17, 2026. The group claims to have taken internal files, yet no independent verification of the data volume, encryption status, or restoration of systems has been made available. Timing of the initial access, the precise method of intrusion, and whether any data was subsequently published remain undisclosed.

The group behind it: lockbit5

LockBit is a ransomware operation that has conducted multiple campaigns since 2019, typically employing encryption paired with data exfiltration to pressure victims. The group maintains a leak site where it lists organizations and, in some cases, releases samples of claimed material. Its listings constitute assertions by the operator rather than independently verified events. Public reporting has documented LockBit’s use of affiliate networks and repeated targeting of government and healthcare entities in prior incidents.

saude.mt.gov.br and its sector

SES-MT administers public health programs, hospital networks, and regulatory functions for the state of Mato Grosso. Entities of this type routinely process records related to patient care, vaccination registries, laboratory results, and administrative operations. A disruption or exposure at such an agency can affect service delivery across an entire region because health secretariats often serve as central points for coordination and data sharing with municipal facilities.

What was likely exposed

The reported information indicates only that internal files were exfiltrated. The exact categories of data contained in those files have not been disclosed. Organizations in this sector commonly hold patient identifiers, medical histories, appointment records, and operational documents; however, whether any of these specific types were among the claimed files cannot be confirmed from available information.

What's at stake

Individuals whose information appears in health-secretariat records face the possibility that personal or medical details could be used for identity-related fraud or unwanted disclosure. For the agency, the incident adds operational strain during any recovery period and may complicate ongoing coordination with other health providers. No public statements have quantified these effects to date.

Were you affected?

Check official communications from SES-MT for any guidance issued to residents. Individuals can also run a free exposure scan of their email address against known breach datasets to see whether their information has appeared in previously published collections. Monitor financial and medical accounts for unusual activity and consider placing fraud alerts with credit bureaus if personal identifiers are suspected to be involved.

AICompiled with AI assistance from public sources and published under our editorial standards.