[EMPERADOR] – Ransomware Victim: Cassias MG Government

Verification alert Listings attributed to EMPERADOR have been reported as including unverified or fabricated victim claims. Treat this post as unconfirmed until corroborated with independent evidence. See further information here: BankInfoSecurity

See further information here: BankInfoSecurity

NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an editorial notice informing that a company has fallen victim to a ransomware attack. RedPacket Security is not affiliated with any ransomware threat actors or groups and will not host infringing content. The information on this page is automated and redacted whilst being scraped directly from the EMPERADOR Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

On September 19, 2026, the threat actors identified as Emperador allegedly listed Cassias MG Government, a Brazilian government-sector organization, on their leak page. Because no separate compromise date is provided, September 19, 2026, is treated as the post date. The post claims unauthorized access to government credentials and systems associated with justice, financial, police, and medical services. It also alleges access to personal and identity-related records, including medical information, national identity records, birth certificates, and Brazilian taxpayer identification data. The post claims that approximately 720 MB of data was obtained from Cassias MG Government and categorizes the alleged material across medical, government, and finance sectors. The available information indicates a data-exposure claim, but does not state that systems were encrypted. The threat actors assert that a negotiation deadline will be provided, although no ransom amount or specific financial demand is listed. The page contains no screenshots or other images, and no downloadable files are indicated.

On September 19, 2026, the threat actors identified as Emperador allegedly listed Cassias MG Government, a Brazilian government-sector organization, on their leak page. Because no separate compromise date is provided, September 19, 2026, is treated as the post date. The post claims unauthorized access to government credentials and systems associated with justice, financial, police, and medical services. It also alleges access to personal and identity-related records, including medical information, national identity records, birth certificates, and Brazilian taxpayer identification data.

The post claims that approximately 720 MB of data was obtained from Cassias MG Government and categorizes the alleged material across medical, government, and finance sectors. The available information indicates a data-exposure claim, but does not state that systems were encrypted. The threat actors assert that a negotiation deadline will be provided, although no ransom amount or specific financial demand is listed. The page contains no screenshots or other images, and no downloadable files are indicated.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.