TJMG Tribunal de Justiça de Minas Gerais · Breach

[Single source] Rhysida ransomware claims attack on Minas Gerais court

Nov 09, 2026 · 1 min read

The Rhysida ransomware group listed the Minas Gerais State Court (TJMG) on its leak site. Preview images reportedly show legal case files, administrative documents and ID scans, with no data volume or deadline given. TJMG has not confirmed the incident; monitor the court's official channels.

By HIFY Radar newsroom Updated 11/09/2026 12:45 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Alleged

The Rhysida ransomware group has listed the Tribunal de Justiça do Estado de Minas Gerais (TJMG), the judiciary of one of Brazil's largest states, on its data-leak site. The listing provides no data volume and no deadline, and TJMG has not publicly confirmed any incident.

What happened

Alleged

Rhysida added the domain tjmg.jus.br to its data-leak site, a move typically used by the group to pressure victims ahead of possible publication or auction of stolen data.

Alleged

Preview images attached to the leak-site listing reportedly show legal case files, administrative documents and ID scans, suggesting the actors may have access to judiciary records.

Observed

As of this report, TJMG has issued no public confirmation of a security incident, and the listing itself specifies neither the volume of data held nor a countdown deadline.

Why it matters

Inferred

Court systems hold case files, sealed proceedings, juvenile records and personal data on parties and staff, so a genuine compromise of TJMG systems would be serious for judicial integrity and privacy in Minas Gerais.

Alleged

Rhysida is described as an established ransomware-as-a-service operation, which would make the claim credible enough to warrant attention from Brazilian authorities and court staff even before any confirmation.

What to do

Inferred

Until TJMG or Brazilian authorities confirm an incident, this should be treated as an unverified threat-actor claim rather than confirmation of a breach.

Inferred

Parties, lawyers and staff with cases before TJMG may reasonably watch for official statements and exercise caution with unsolicited communications referencing court case files, since leaked listings are sometimes paired with targeted phishing.

Confirmed and still uncertain

Alleged

Known: Rhysida has listed tjmg.jus.br on its data-leak site, with preview images reportedly showing case files, administrative documents and ID scans, and no data volume or deadline has been given.

Inferred

Unknown: whether an actual intrusion into TJMG systems occurred, how much data (if any) was taken, when or whether publication or auction might follow, and who is behind the listing. No official confirmation or denial exists yet.

What people are saying

Observed

DailyDarkWeb, a dark-web monitoring account on X, broke the listing publicly and added an analyst note stressing that court compromises would be serious but that the claim remains unverified until TJMG or Brazilian authorities confirm.

Observed

No statement from TJMG, Brazilian judicial bodies, law enforcement or Rhysida itself beyond the leak-site entry is reflected in the current evidence batch.

Evolution

Alleged

Rhysida typically lists victims on its leak site weeks after the initial intrusion and later auctions or dumps the stolen data, so further escalation is plausible if the claim proves genuine.

Inferred

At this stage there is no observed auction, dump or countdown tied to TJMG, meaning the situation may stay static if it is a pressure tactic or false listing.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The claim surfaced via a data-leak site entry, the standard extortion channel for ransomware-as-a-service operations like Rhysida, where the domain tjmg.jus.br was listed (defanged as tjmg[.]jus[.]br in reporting).

Inferred

The listing includes no encryption proof, sample archives, or deadline timer, which are elements sometimes provided in leak-site entries and whose absence limits technical verification of the claim.

Sources and evidence

Observed

This report rests on a single item: a post by DailyDarkWeb on X (published with the leak-site screenshots referenced), which itself frames the event as an unverified threat-actor claim pending official confirmation.

Inferred

Confidence is low-to-moderate: leak-site listings are verifiable as listings, but attribution of an actual TJMG breach cannot be established from one third-party threat-intelligence post with no corroboration from TJMG or Brazilian authorities.