Minas Gerais Court Ransomware Claim by Rhysida (Nov 2026)

Claim Summary

The Rhysida ransomware group has allegedly listed the Tribunal de Justica do Estado de Minas Gerais (the Court of Justice of the State of Minas Gerais, Brazil) on its dark web leak site. According to the threat actor, the claim was posted on or around November 7, 2026. The group purports to have exfiltrated data from the organization, though the volume of allegedly stolen data is listed as undisclosed. No data samples, file listings, or proof-of-compromise artifacts have been independently reviewed by Yazoul Security at the time of writing.

This claim remains unverified. The mere appearance of an organization on a leak site does not confirm that a breach occurred, nor does it confirm the scope or sensitivity of any data the group claims to hold.

Threat Actor Profile

rhysida is a ransomware operation that emerged publicly in mid-2023 and is widely assessed by researchers as a Ransomware-as-a-Service (RaaS) outfit. The group is known for double extortion tactics, exfiltrating data before encryption and threatening publication to pressure victims into payment. Rhysida has historically targeted a broad range of sectors, including healthcare, education, manufacturing, and government entities.

Public reporting has linked Rhysida tooling to the use of Cobalt Strike beacons, living-off-the-land techniques, and lateral movement via compromised credentials and remote access. Specific tooling and total victim counts for this campaign are not publicly documented in the source data provided, and the group’s known victim tally is listed as unknown. No dedicated public research references were supplied alongside this claim, which limits confidence in any attribution or capability assessment. Analysts should treat capability details as general background rather than confirmed specifics for this incident.

Alleged Data Exposure

The threat actor claims to have obtained data belonging to the Minas Gerais state court. However, the group has not publicly disclosed the data volume, the categories of records allegedly taken, or any supporting evidence such as screenshots or file trees. Because ransomware operators routinely exaggerate or fabricate claims to increase pressure on victims, the alleged exposure should be treated with skepticism until corroborated. No samples, credentials, or download references are reproduced here, in line with responsible disclosure practice.

Potential Impact

If the claim is accurate, a breach of a state judicial body could raise serious concerns around the confidentiality of case-related records, internal administrative data, and potentially personal information of parties involved in legal proceedings. Judicial institutions are attractive targets because operational disruption carries outsized public consequences. That said, none of this is confirmed. The organization has not, to our knowledge, issued a public statement confirming or denying the claim. Impact assessment must remain provisional.

What to Watch For

• Official statements from the Tribunal de Justica do Estado de Minas Gerais confirming, denying, or downplaying the claim.
• Independent corroboration from Brazilian CERT authorities or judicial oversight bodies.
• Any leak site updates from Rhysida adding proof-of-compromise artifacts or revising the data volume.
• Signs of operational disruption to court services in Minas Gerais.
• Related Rhysida activity against other Brazilian government entities, which could indicate a regional campaign.

Organizations in the government and legal sector should review detection coverage for common Rhysida tradecraft and validate backup and incident response readiness. See our advisory resources at /advisory/ for general ransomware resilience guidance.

Disclaimer

This report is based solely on an unverified claim posted to a ransomware group’s leak site. Yazoul Security has NOT independently verified that a breach occurred, that any data was exfiltrated, or that the stated details are accurate. Ransomware groups frequently exaggerate or misrepresent claims to pressure victims. Nothing in this article should be treated as confirmation of a security incident. Readers should await official confirmation from the organization or authoritative bodies before drawing conclusions.