Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Significant cyber incident
ConecteSUS and Ministry of Health systems attack, Brazil, 2021
On 10 December 2021 the Brazilian Ministry of Health website, the ConecteSUS app and several national health systems went offline after an attack on the ministry's cloud environment.
In short
On 10 December 2021 the Brazilian Ministry of Health website, the ConecteSUS app and several national health systems went offline after an attack on the ministry's cloud environment. A group calling itself Lapsus$ Group claimed the attack on the ministry pages. The Federal Police later said the intruders deleted files, data and instances in the cloud. The vaccination certificate app stayed offline until 23 December.
What happened
In the early hours of Friday 10 December 2021 the Ministry of Health website and the ConecteSUS page and app were broken into. ConecteSUS gives Brazilians the National COVID-19 Vaccination Certificate. The ministry page came back the same morning, but vaccine data stayed out of reach. The e-SUS Notifica system for COVID-19 reports and the national immunisation system (SI-PNI) were also hit (Agência Brasil, 10 December 2021).
A message on the ministry pages was signed by a group calling itself Lapsus$ Group. It said the data of the systems had been copied and deleted and asked visitors to make contact to get the data back. The ministry said it had called in the Institutional Security Cabinet (GSI) and the Federal Police.
The ConecteSUS app was offline for 13 days and the ministry said on 23 December 2021 that it was restored. Many states found it hard to send COVID-19 case and death data in that period. The Federal Police launched Operation Dark Cloud in August 2022 and arrested a suspect in October 2022. In 2024 an ANPD staff report recommended warnings for the ministry under the data protection law.
Timeline
-
9 December 2021 (night)
The ministry incident response team finds abusive use of an active employee account outside working hours, according to the ANPD report.
-
10 December 2021
Ministry sites, ConecteSUS, e-SUS Notifica and SI-PNI go down. A message signed Lapsus$ Group appears. The ministry calls in the GSI and the Federal Police.
-
10 December 2021
The Federal Police opens an inquiry. The ANPD says it is monitoring the case and notifies the ministry. The Senate schedules a hearing on personal data security for 15 December.
-
13 December 2021
The GSI says there were new cyber incidents against government bodies in a cloud environment and does not name the services.
-
22 December 2021
Rádio Senado reports that 14 states have stopped publishing their COVID-19 statistics.
-
23 December 2021
The ministry says the ConecteSUS app is restored after being offline since 10 December.
-
6 January 2022
The ministry tells the ANPD its AWS account infrastructure was deleted, that it was not ransomware and that there was no data loss.
-
16 August 2022
The Federal Police launches Operation Dark Cloud with eight search warrants in four states.
-
19 October 2022
The Federal Police arrests in Feira de Santana the main Brazilian suspect of being part of the Lapsus Group.
-
2024
The ANPD instruction report number 5 recommends two warnings to the ministry under the data protection law.
How the attack worked
The public sources do not give the first entry route. The best description comes from the ANPD instruction report on the ministry’s own incident findings. The report is a regulator document, and parts of it are marked restricted, so some detail is left out.
A valid account was used
The ministry incident response team found, on the night of 9 December 2021, abusive and suspicious use of an active account of a ministry employee outside working hours. The team concluded the credential was valid but that the employee was not directly involved in the attack. This is Valid Accounts (T1078).
Discovery and more privilege
System logs showed that after the login the account ran a series of commands to list users and permissions, and then the privilege of the account was raised. Listing users is Account Discovery (T1087).
Mass deletion in the cloud
The attacker then ran an automated process to delete the assets of the Datasus cloud infrastructure in bulk. The ministry told the ANPD that its AWS account, which hosted ConecteSUS, Notifica, SIPNI and RNDS, had its network and server infrastructure deleted. Deleting data to cut off services matches Data Destruction (T1485), but the sources opened do not use that label.
Redirection and message
The report says DNS records were changed so that access to the ministry systems went to a page hosted outside Brazil, in Seychelles. The Federal Police said users who opened the ministry site found a note saying the data had been copied and deleted.
Recovery
Because the account was unstable and services were critical, the ministry built a new virtual environment and kept the old one for audits. It took several days to restore services fully.
- Valid accountAn active ministry employee account was used outside working hours, found by the ministry team on the night of 9 December 2021Technique T1078 (MITRE ATT&CK, opens in a new tab)
- DiscoveryCommands listed users and permissions, then the account privilege was raisedTechnique T1087 (MITRE ATT&CK, opens in a new tab)
- Mass deletionAn automated process deleted the Datasus cloud infrastructure assets in bulk
- DNS changeDNS records sent ministry system traffic to a page hosted in Seychelles
- MessageVisitors saw a note signed Lapsus$ Group saying data was copied and deleted
- RebuildThe ministry built a new environment and restored services over several days
ATT&CK techniques
- Technique Account Discovery Account Discovery is when an attacker builds a list of valid accounts, usernames or email addresses on a system or inside a compromised environment. T1087 · Discovery
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Who says who was behind it
Who attributed it, and how firm it is
Claimed by a group signing as Lapsus$ Group in a message on the ministry pages, 10 December 2021 (reported by Agência Brasil, the state news agency).
Attributed by the Federal Police, 16 August 2022: the attacks on federal bodies, among them the Ministry of Health, were carried out by a transnational criminal organization. The release does not name the group.
Attributed by the Federal Police, 19 October 2022: the arrested man is the main Brazilian suspect of being part of the transnational criminal organization it calls Lapsus Group, and the inquiry covers the attacks of late 2021 on the ministry and dozens of other federal bodies.
Sources differ on method and data: the group's message said data was copied and deleted. The ministry told the ANPD on 6 January 2022 that it was an attack with destruction of the environment, not ransomware, with no evidence of data leaks. The ANPD report states no loss, breach or exfiltration was established.
No court finding is in the sources opened. The arrested man is a suspect.
Impact
Ministry of Health website, ConecteSUS page and app, e-SUS Notifica and SI-PNI were unavailable from 10 December 2021 (Agência Brasil).
The ConecteSUS app stayed offline until 23 December 2021. Issuing the National COVID-19 Vaccination Certificate could still be unstable after that because of high demand (Agência Brasil, 23 December 2021).
The daily COVID-19 bulletin was hurt because several states could not update case and death data (Agência Brasil, 23 December 2021). Rádio Senado reported on 22 December that 14 states had stopped publishing statistics.
The ANPD report lists seven affected systems: CADSUS, SGOP, ConecteSUS, Notifica, CoronavirusSUS, SIPNI and RNDS, and describes the platform as holding personal health data of millions of Brazilians.
The ministry said there was no data loss. The ANPD report says the incident did not bring loss, breach or exfiltration but made many essential services unavailable.
The Federal Police said the group also reached the virtual environments of other federal bodies, among them the Comptroller General and the Ministry of Economy.
Costs are not stated in the sources opened.
Government and regulator response
- 10 December 2021: The ministry said it had called in the GSI and the Federal Police, and that Datasus was working to restore the platforms. The ANPD said it was monitoring the case and notified the ministry to give explanations. The Federal Police opened an inquiry the same day.
- 10 December 2021: The Senate Science and Technology Committee scheduled a public hearing for 15 December on personal data security. The Senate news item said the ministry guaranteed a backup of the information exists.
- 13 December 2021: The GSI said cloud providers were cooperating and that teams were being guided on evidence preservation.
- Date not stated: The ministry built a new virtual environment and kept the old one for audits.
- 23 December 2021: The ministry said ConecteSUS was restored.
- 6 January 2022: The ministry answered the ANPD. The ANPD later opened a sanction process citing the data protection officer, the impact reports and the incident notice.
- 16 August 2022: Federal Police Operation Dark Cloud, eight search warrants in Paraíba, Minas Gerais, Paraná and Santa Catarina.
- 19 October 2022: Federal Police arrest in Feira de Santana.
- 2024: The ANPD instruction report number 5 recommended a warning for failing to prove a data protection officer, and a warning with two corrective measures for the impact report. It set aside the alleged breach of article 48. The sources opened do not show the final decision.
Lessons
-
One valid account can reach a whole cloud estate
The ministry team found the attacker used an active employee account, and the employee was not directly involved. Limit what one account can do and watch odd hours.
-
Cloud admin actions need alerts
After login the account listed users and permissions and raised its privilege, then bulk deleted infrastructure. Alert on privilege changes and mass deletion.
-
Backups must be separate and tested
The ministry said there was no data loss, yet services took 13 days to come back and a new environment had to be built. Keep and test copies outside the same account.
-
Public health services depend on a few platforms
One cloud account held ConecteSUS, Notifica, SIPNI and RNDS. When it was deleted, vaccine certificates and COVID-19 reporting stopped together.
-
Governance gaps show up after the incident
The ANPD report says the ministry had no data protection officer at the time and sent impact reports late. Name owners and write the reports before an incident.
-
Say clearly what is known
The group said data was copied. The ministry said no evidence of data leaks. Publish what is confirmed and what is a claim.
What to check in your own organization
-
Cloud account activity at night
Alert on admin logins and role changes outside working hours in your cloud accounts, and on logins from unusual places.
-
Privilege changes
Alert when an account lists users and permissions and then raises its own rights.
-
Mass deletion controls
Require extra approval, or deletion protection, for bulk deletion of servers, networks and storage in cloud accounts.
-
Separate backups
Keep backup copies in a different account that the production admin login cannot delete, and test a restore with a timer.
-
DNS change control
Lock DNS and registrar accounts with strong sign-in, and alert on any change to records for public services.
-
Single points of failure
List the public services that sit in one cloud account and decide what you do if that account is lost.
-
Data protection roles
Check that a data protection officer is named, impact reports exist for critical systems, and who tells the regulator and the public.
Where it happened
- Country Brazil Brazil faces banking trojans and fraud, ransomware against health services and other organizations, and state-linked campaigns. Latin America
- Industry Healthcare and pharma Ransomware, stolen staff logins, patient data on leak sites and supplier exposure at hospitals and drug makers, and the rules that apply.
Questions
What happened to the Brazilian Ministry of Health in December 2021?
On 10 December 2021 the ministry website, the ConecteSUS app and other health systems went offline after an attack on its cloud environment. ConecteSUS was restored on 23 December.
Who was behind it?
A group signing as Lapsus$ Group claimed it. The Federal Police later arrested a Brazilian suspect it linked to the Lapsus Group, and said the attacks were by a transnational criminal organization.
Was data stolen?
The group said data was copied and deleted. The ministry told the ANPD it was an attack with destruction, not ransomware, with no evidence of data leaks and no data loss. Sources differ.
How did the attackers get in?
The public sources do not give the first entry route. The ministry team found a valid employee account used outside working hours, and said the employee was not directly involved.
What did the regulator do?
The ANPD notified the ministry on 10 December 2021 and later ran a sanction process. A 2024 report recommends two warnings. The sources opened do not show the final decision.
In our research
- LAPSUS$ Threat group
Sources
- Sites e aplicativo do Ministério da Saúde sofrem ataque cibernético (10 December 2021) Agência Brasil (EBC)
- Órgãos do governo sofrem novo ataque de hackers, diz GSI (13 December 2021) Agência Brasil (EBC)
- Aplicativo ConecteSUS é restabelecido, diz Ministério da Saúde (23 December 2021) Agência Brasil (EBC)
- CCT vai debater vazamento de dados após ataque ao ConecteSUS (10 December 2021) Agência Senado
- Ataque hacker ainda prejudica dados sobre a covid-19 (22 December 2021) Rádio Senado
- ANPD fiscaliza incidente do Ministério da Saúde e Conecte SUS (10 December 2021) Autoridade Nacional de Proteção de Dados (archived copy)
- PF realiza operação para apurar ataques a sites do Governo Federal (16 August 2022) Polícia Federal (archived copy)
- PF prende brasileiro suspeito de integrar organização criminosa internacional (19 October 2022) Polícia Federal (archived copy)
- Relatório de Instrução nº 5/2024, Processo 00261.000456/2022-12 Autoridade Nacional de Proteção de Dados
- Brazilian police launch investigation targeting Lapsus$ group The Record, August 2022
- Brazil arrests suspect believed to be a Lapsus$ gang member BleepingComputer, October 2022
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.