A cyber incident occurred in the early hours of 19–20 June 2026, when the mobile phones of approximately thirty million people across eight Brazilian states and the Federal District received a false notification classified as an "Extreme Alert" by Brazil's official Civil Defense system.

The message contained only the word "misanthropy", a term meaning aversion to or hatred of humanity, and bore no relation to any weather event or actual emergency situation. The National Secretariat for Civil Protection and Civil Defense, part of the Ministry of Integration and Regional Development (MIDR), confirmed that the "Defesa Civil Alerta" system had been breached by an external actor and called in the Federal Police to investigate the incident. The platform was taken offline as a precautionary measure.

Background On December 4, 2024, the Ministry of Integration and Regional Development from Brazil inaugurated the platform alerts "Defesa Civil Alerta" in states of South. The channel used by the service is 50.

The system uses Cell Broadcast technology, which allows alerts to be sent directly to mobile phones in at-risk areas without requiring prior registration or app installation. These messages are typically used to warn the public about natural phenomena—such as storms, floods, and other events posing an imminent threat. The "Extreme Alert" level is the system's most severe category, usually reserved for imminent natural disasters. Unlike other notification systems, "Defesa Civil Alerta" cannot be blocked by features such as "Silent Mode" or "Do Not Disturb" on mobile phones; in situations classified as extreme risk, the notification is accompanied by a siren-like sound.

The platform responsible for sending alerts is the Public Alert Dissemination Interface (IDAP), operated by the Ministry of Regional Development (MIDR) in conjunction with the National Civil Defense. IDAP brings together more than 180 registered institutions and approximately 600 users authorized to issue alerts at the state and municipal levels, and allows messages to be sent through different channels, including SMS, Telegram, WhatsApp, Google Public Alerts, cable television, and the Cell Broadcast system.

The attacks Around 11:41 PM on June 19, 2026, the first false alert was sent in state of Rio de Janeiro, exactly eleven minutes after the match between Brazil and Haiti for Group C the 2026 FIFA World Cup. Shortly after, at 11:45 PM, Curitiba received the false alert.

In the early hours of June 20, around 1:20 a.m., at least seven states simultaneously received the audible alert. The Civil Defense system was immediately deactivated at 1:30 a.m. According to the National Secretary for Civil Protection and Defense, Wolnei Wolff, ten false alerts were issued. Of these, nine were sent via the Cell Broadcast system and one via SMS.

Content of messages The false alert contained the message "Extreme Alert. Defesa Civil: misantropi4" in the title and "Misantropo ADRESS RJ burros dms pprt". Warnings of a possible alien invasion were also received by residents of Belo Horizonte.

Reach

A preliminary analysis indicated that the alerts reached approximately thirty million people across eight Brazilian states and the Federal District, notably in the following capitals:

Belo Horizonte (Minas Gerais) Brasília (DF) Campo Grande (Mato Grosso do Sul) Curitiba (Paraná) Rio Branco (Acre) Rio de Janeiro (RJ) Salvador (Bahia) São Paulo (SP)

Investigations

Access method In a report submitted to the Federal Police, the Federal Government—through the Ministry of Integration and Regional Development (MIDR)—stated in a document released to the press on June 21 that the attack on IDAP (Population Alert Data Integration), the system responsible for National Civil Defense alerts, originated from two agency credentials linked to Pará (likely compromised). Pará was one of the states not affected by the false alarms, although there had been an unsuccessful attempt to access the system from that state and others across Brazil. One stolen credential had been immediately blocked by an on-duty team during the intrusion on the 19th, but a second credential remained in use; it was through this second one that the alerts were triggered in the early hours of the 20th.

The method used is known in the cybersecurity field as "credential stuffing", which involves using logins and passwords previously exposed in data breaches to attempt access to other systems. According to the alleged intruder, IDAP's only verification mechanism consisted of elementary mathematical operations—such as simple addition—rather than a robust CAPTCHA. The credentials involved belonged to three officials: one with permission to issue alerts for eight states, another authorized only for Rio de Janeiro, and a third with access restricted to Curitiba. The credential with the widest scope—where the individual's CPF (tax ID) had been used as both the username and the password—belonged to a Second Sergeant in the Pará Military Fire Corps; his identity was inadvertently revealed in a video released by the intruder himself on X. The incident exposed structural vulnerabilities in IDAP, such as the lack of multi-factor authentication and the absence of procedures for periodic credential renewal. Surveys conducted by the portal TecMundo indicate that the alleged hacker obtained leaked credentials belonging to public servants—granting access to the IDAP system and the ability to issue alerts—via websites and Telegram channels. One hypothesis is that the CPF numbers of three public servants from Pará (rather than two, as indicated in the MIDR investigation) were used as passwords to access the system. On July 10, 2026, the Ministry of Integration and Regional Development reported that the hacker had learned how to send false alerts in a course offered by the federal government.

In March 2026, three months prior to the incident, a retired police officer was targeted by Operation Nexus Fractus, which investigated the unauthorized use and collection of information from public agency databases.

Suspected perpetrator A domain registered as "misantropi4.com" was active over the weekend of the incident, as was an X user named Misantropo (@mizantropiaz) who claimed responsibility for the breach; the user posted screenshots of the IDAP system and the Civil Defense Alert (DCA) platform, along with a video demonstrating how to access the system via a tutorial (which was later deleted). The hacker, whose identity remains undisclosed, announced plans to give an exclusive interview to the news outlet TecMundo. Coincidentally, a Brazilian progressive rock band named Misantropia HC emerged as a suspect in the attack. Although the band—which had been inactive since 2024—took the opportunity to post an Instagram Story attacking groups linked to fascism, they denied responsibility for the incident and ruled out any connection to the release of a supposed album. Additionally, another musical group with the same name also denied any involvement in the matter.

Reactions

National Civil Defense In an official statement, the National Secretariat for Protection and Civil Defense confirmed that the alert was triggered remotely by someone outside the National System for Protection and Civil Defense, classifying the incident as a "probable hacker attack." The agency took the platform offline as a precaution and announced it would call in the Federal Police to investigate the matter.

Federal Police The Federal Police were called in by the National Secretariat for Protection and Civil Defense to investigate the authorship and scope of the cyberattack. The primary line of investigation pointed to a coordinated hacker attack on the IDAP/Cell Broadcast system.

Anatel The National Telecommunications Agency (Anatel) was also notified of the incident by state civil defense agencies. CNN Brasil reported contacting Anatel, which had not responded by the time the story was published. In a subsequent statement, the agency confirmed that its own systems were not compromised and that the incident was confined to the IDAP system, noting that its role is limited to technical support and carrier regulation, while investigations fall to the competent authorities.

States

The Government of Paraná confirmed that the alert was not issued by the state Civil Defense and notified both the National Civil Defense and Anatel. Paraná's State Secretariat of Justice and Citizenship issued a statement indicating that the conduct could, in theory, fall under the Anti-Terrorism Law, which carries a penalty of 12 to 30 years in prison for anyone who uses cyber mechanisms to sabotage or seize control of communication channels with the intent of inciting widespread public terror. Rio de Janeiro's Civil Defense confirmed that it did not issue any alert and that the notification stemmed from "instability in the IDAP/Cell Broadcast alert-sending system, a platform managed by the National Civil Defense." São Paulo's Civil Defense reported that it did not issue any alert related to the content received.

References