Brazil
BR #7 Most TargetedRansomware victim intelligence profile · Ranked #7 globally · Updated: Sep 6, 2026
ThreatAI Analysis
Compiled from this database and the ransomware.live profiles of the groups active in Brazil. Figures are computed from the tracked records, not inferred.
Brazil experiences 434 recorded ransomware attacks globally ranking 7th, with Ransomhub and Lockbit5 most frequently targeting Business Services and Technology sectors.
Brazil in the global picture
Brazil accounts for 447 of the ransomware disclosures tracked here, ranking #7 worldwide and making up 2.1% of the global total. The sectors listed most often are Business Services, Technology, Manufacturing.
Who is most active in Brazil
Ransomhub — 35 victims in Brazil. The group emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks, resulting from extortion through encryption and data leaks. Thegentlemen — 29 victims in Brazil. Lockbit5 — 27 victims in Brazil.
Ransomware Threat Profile: Brazil
Brazil ranks #7 globally for ransomware attacks, with 447 confirmed victims in this database — representing 2.1% of the worldwide total. The most active ransomware groups targeting Brazil include Ransomhub, Thegentlemen, Lockbit5.
The most frequently targeted industries in Brazil are Business Services, Technology, Manufacturing. The healthcare sector is particularly vulnerable because attacks on hospitals and medical providers can create life-threatening situations, increasing pressure to pay ransoms quickly.
Brazil's attack volume reflects broader trends in ransomware targeting: as a major economy with advanced digital infrastructure and numerous large enterprises, Brazil is a high-value target for ransomware operators seeking large ransom payments.
Organisations in Brazil should consider the active threat groups documented here when assessing their cybersecurity posture, implementing detection rules, and prioritising incident response planning.
Recent Victims in Brazil (showing 100 of 447)
| # | Organization | Group | Sector | Date |
|---|---|---|---|---|
| 1 | Lider Aviacao | Thegentlemen | Transportation | Sep 5, 2026 |
| 2 | Engefitas | Vexy ransomware | Energy & Utilities | Sep 3, 2026 |
| 3 | ialegre.com | Settra | Other | Sep 3, 2026 |
| 4 | Oportunidados | Direwolf | — | Sep 1, 2026 |
| 5 | Exacta Optech Labcenter | Thegentlemen | Healthcare | Aug 30, 2026 |
| 6 | frm.ind.br | Zawoo | Other | Aug 30, 2026 |
| 7 | Uniguacu | Emperador | Other | Aug 29, 2026 |
| 8 | amzur.com | Unsafe | — | Aug 28, 2026 |
| 9 | sysconth.com | Krybit | Technology | Aug 26, 2026 |
| 10 | TEC Container | Thegentlemen | Manufacturing | Aug 26, 2026 |
| 11 | vascara.com | Krybit | Retail & E-Commerce | Aug 26, 2026 |
| 12 | www.neooftalmo.com.br | Krybit | Healthcare | Aug 26, 2026 |
| 13 | Frato | Dragonforce | Other | Aug 24, 2026 |
| 14 | Brazil Mobilemed: Cloud PACS Platform | Kazu | Healthcare | Aug 23, 2026 |
| 15 | Meducar: Telemedicine and Patient Management System | Kazu | Healthcare | Aug 23, 2026 |
| 16 | UOLconsult | Thegentlemen | Professional Services | Aug 21, 2026 |
| 17 | Prefeitura Municipal de Arcos | Emperador | Government & Defense | Aug 18, 2026 |
| 18 | Vermont XCenter | Dragonforce | — | Aug 17, 2026 |
| 19 | TOTVS | Direwolf | Technology | Aug 15, 2026 |
| 20 | VR Advogados | Barracuda | Professional Services | Aug 15, 2026 |
| 21 | Megalaser Industria Metalurgica LTDA | Thegentlemen | Manufacturing | Aug 14, 2026 |
| 22 | tecnoabi.com | M3rx | Technology | Aug 14, 2026 |
| 23 | Vector Two Technology | Thegentlemen | Technology | Aug 14, 2026 |
| 24 | Chat Jurídico | Direwolf | Professional Services | Aug 10, 2026 |
| 25 | Alya Construtora | Ransomhouse | Manufacturing | Aug 7, 2026 |
| 26 | brdigital.net.br | L group | Technology | Aug 7, 2026 |
| 27 | Intranet Gov Brasil | Thegentlemen | Government & Defense | Aug 7, 2026 |
| 28 | uva.edu.br | L group | Education | Aug 7, 2026 |
| 29 | PontoBR Sistemas | Spacebears | Technology | Aug 5, 2026 |
| 30 | cesmac.edu.br | Krybit | Education | Aug 4, 2026 |
| 31 | eSysTech | Orova | Technology | Aug 4, 2026 |
| 32 | rai.com.br | Lockbit5 | Other | Aug 3, 2026 |
| 33 | CRB group | Thegentlemen | Professional Services | Jul 31, 2026 |
| 34 | The Municipal Chamber of Serra | Thegentlemen | Government & Defense | Jul 31, 2026 |
| 35 | *****.com.br | Section9 | Financial Services | Jul 26, 2026 |
| 36 | ****.com.br | Section9 | Technology | Jul 26, 2026 |
| 37 | ******.com.br | Section9 | Other | Jul 26, 2026 |
| 38 | ********.com.br | Section9 | — | Jul 26, 2026 |
| 39 | *****.ind.br | Section9 | Agriculture and Food Production | Jul 26, 2026 |
| 40 | ******.net.br | Section9 | Financial Services | Jul 26, 2026 |
| 41 | Power Moendas | Arcusmedia | Other | Jul 26, 2026 |
| 42 | Sinop Energia | Global secret group | Energy & Utilities | Jul 26, 2026 |
| 43 | SPDM | Global secret group | Healthcare | Jul 26, 2026 |
| 44 | msgas.com.br | Blackwater | Energy & Utilities | Jul 25, 2026 |
| 45 | Cpcg | Qilin | Other | Jul 22, 2026 |
| 46 | Jota Joias Premium | Nova | Consumer Services | Jul 19, 2026 |
| 47 | Jota Joias Premium | Nova | Consumer Services | Jul 19, 2026 |
| 48 | PP+K | Qilin | — | Jul 19, 2026 |
| 49 | PP+K | Qilin | Manufacturing | Jul 19, 2026 |
| 50 | Reni Farmácias Associadas | Doommageddon | Healthcare | Jul 19, 2026 |
| 51 | Reni Farmácias Associadas | Doommageddon | Healthcare | Jul 19, 2026 |
| 52 | FMZ Tecnologia em Sistemas | Nova | Technology | Jul 18, 2026 |
| 53 | FMZ Tecnologia em Sistemas | Nova | Technology | Jul 18, 2026 |
| 54 | acilab.com | Settra | Technology | Jul 16, 2026 |
| 55 | Megawork | Ransomhouse | Business Services | Jul 16, 2026 |
| 56 | Bombas Ideal | Deadlock | Manufacturing | Jul 10, 2026 |
| 57 | Direção Estacionamentos S.A. | Deadlock | Consumer Services | Jul 10, 2026 |
| 58 | Werken Química Brasil S.A. | Deadlock | Manufacturing | Jul 10, 2026 |
| 59 | S.J. Louis | Qilin | — | Jul 8, 2026 |
| 60 | tecnocurva.com.br | Incransom | Technology | Jul 7, 2026 |
| 61 | Francisco Imóveis | Doommageddon | Consumer Services | Jul 6, 2026 |
| 62 | redeplastrs.com.br | Blackfield | Manufacturing | Jul 3, 2026 |
| 63 | carvalima.com.br | Incransom | Business Services | Jul 2, 2026 |
| 64 | ezortea.com.br | Incransom | Consumer Services | Jul 2, 2026 |
| 65 | flazio.com | Apt73 | Technology | Jul 2, 2026 |
| 66 | Service IT | Worldleaks | Business Services | Jul 2, 2026 |
| 67 | tambasa.com | Incransom | Retail & E-Commerce | Jul 2, 2026 |
| 68 | Estrela | Medusalocker | Consumer Services | Jul 1, 2026 |
| 69 | paipharma.com | Braincipher | Healthcare | Jun 30, 2026 |
| 70 | agroprime | Dragonforce | Agriculture and Food Production | Jun 29, 2026 |
| 71 | gov.br | Apt73 | Public Sector | Jun 23, 2026 |
| 72 | Meta | Bravox | Technology | Jun 23, 2026 |
| 73 | 5deagosto.com.br | Lockbit5 | Consumer Services | Jun 20, 2026 |
| 74 | Editora Irmãos Vitale | Payload | Education | Jun 20, 2026 |
| 75 | saude.mt.gov.br | Lockbit5 | Public Sector | Jun 20, 2026 |
| 76 | Super Finishing | Worldleaks | Manufacturing | Jun 20, 2026 |
| 77 | coemi.com.br | Krybit | Financial Services | Jun 19, 2026 |
| 78 | www.mupras.com | Krybit | Business Services | Jun 19, 2026 |
| 79 | Chebib Control | Spacebears | Business Services | Jun 17, 2026 |
| 80 | Gerencial | Spacebears | Business Services | Jun 17, 2026 |
| 81 | Clínica Vida | Direwolf | Healthcare | Jun 12, 2026 |
| 82 | MHE9 Logística Ltda | Gunra | Transportation/Logistics | Jun 12, 2026 |
| 83 | ws.com.br | Threeam | Business Services | Jun 12, 2026 |
| 84 | grupodetoni.com.br | Lockbit5 | Business Services | Jun 11, 2026 |
| 85 | lbreng.com.br | Lockbit5 | Business Services | Jun 11, 2026 |
| 86 | santoinacio-rio.com.br | Lockbit5 | Business Services | Jun 11, 2026 |
| 87 | Silmquinas e Equipamentos | Thegentlemen | Manufacturing | Jun 11, 2026 |
| 88 | sweetome.com | Lockbit5 | Consumer Services | Jun 11, 2026 |
| 89 | schultz.com.br | Krybit | Business Services | Jun 5, 2026 |
| 90 | Sicol | Spacebears | Manufacturing | Jun 4, 2026 |
| 91 | Eat Salad | Qilin | Agriculture and Food Production | Jun 3, 2026 |
| 92 | Grupo Mauá | Bravox | Manufacturing | May 31, 2026 |
| 93 | BC3 Tecnologia | Nova | Technology | May 30, 2026 |
| 94 | dxon.com.br | 0day syndicate | Business Services | May 28, 2026 |
| 95 | SECONT Secretaria de Controle e Transparência | Nova | Public Sector | May 24, 2026 |
| 96 | Grupo Alvorada | Thegentlemen | — | May 15, 2026 |
| 97 | Colegio Notre Dame Campinas | Thegentlemen | Education | May 6, 2026 |
| 98 | Complastex.com | Qilin | Manufacturing | May 6, 2026 |
| 99 | Bandeirante Supermercados | Medusalocker | Consumer Services | May 5, 2026 |
| 100 | CEAGESP / Netfeirasp | Medusalocker | Agriculture and Food Production | May 5, 2026 |
Frequently Asked Questions
How many ransomware attacks have occurred in Brazil?
Brazil has recorded 447 ransomware victim disclosures in this database, ranking #7 globally. This represents 2.1% of all tracked ransomware attacks worldwide.
Which ransomware groups target Brazil?
The ransomware groups most active in Brazil are Ransomhub, Thegentlemen, Lockbit5, Arcusmedia. These groups collectively account for the majority of victim disclosures attributed to Brazil.
Which industries are most targeted by ransomware in Brazil?
In Brazil, the most frequently targeted sectors are Business Services, Technology, Manufacturing. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.
How does Brazil rank globally for ransomware attacks?
Brazil ranks #7 globally for ransomware attacks with 447 victim disclosures, representing 2.1% of the worldwide total of 21,388 tracked victims.
How can organisations in Brazil protect against ransomware?
Organisations in Brazil should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Brazil is also recommended.