Skip to content
Leak-site post naming RECEITA FEDERAL DO BRASIL, captured by ThreatCluster

RECEITA FEDERAL DO BRASIL

emperador

Ransomware leak-site victim intelligence · EN

Data size
6.3 GB
Files
2
Views
32,698
Posted
Sep 23, 2026
Country
Brazil
Industry
government

Summary

Written by ThreatClusterfrom file listing, victim profile, leak post, screenshot

Emperador's leak states that 6.3 GB of data from the Ministério da Fazenda (Receita Federal do Brasil) were exfiltrated in two zip archives named receita_federal_do_brasil.data1.zip and receita_federal_do_brasil.data2.zip. The group claims the archives contain personnel data, customer data, and user data on gov.br with passwords. Victim identified on the leak page is MINISTÉRIO DA FAZENDA, domain servicos.receitafederal.gov.br. The leak post is published.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Domains
servicos.receitafederal.gov.br

What was taken

MINISTÉRIO DA FAZENDA SECRETARIA DA RECEITA FEDERAL DO BRASIL The archives contain several thousand documents with personnel and customer data, as well as all user date on gov.br with passwords.

Data categories
personnel datacustomer datapasswords
File types seen
zip × 2
Sample files (2)
receita_federal_do_brasil.data1.zip
receita_federal_do_brasil.data2.zip

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Gallery
Proof Image
To Publish
receita_federal_do_brasil.data1.zip (2.9 GB); receita_federal_do_brasil.data2.zip (3.4 GB)
publication_label
To Publish

Leak-site images (4)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
The image features a stylized red logo resembling a geometric figure with sharp angles and a central emblem that suggests a face or mask.
onion leak page1.2 MB
Screenshot of a table containing personal data, including names, CPF numbers, and birthdates.
onion leak page27 KB
Form titled "SOLICITAÇÃO DE ALTERAÇÃO CADASTRAL" with sections for contributor identification, company details, and legal nature, including fields for social capital and business name.
onion leak page40 KB