On June 19–20, 2026, Brazil’s Defesa Civil Alerta system sent ten unauthorized emergency notifications—nine through Cell Broadcast and one by SMS—to approximately 30 million people across eight states and the Federal District. The messages falsely carried the system’s highest “Extreme Alert” classification and included the word “misanthropy,” along with insulting text unrelated to any disaster. Because extreme alerts override Silent Mode and Do Not Disturb settings and emit a siren-like sound, the incident disrupted residents nationwide. The platform was disabled at about 1:30 a.m. as a precaution, and Brazil’s National Secretariat for Protection and Civil Defense referred the case to the Federal Police.
A June 21 government report said the intrusion used two agency credentials associated with Pará, apparently obtained through credential stuffing. One account reportedly used a public servant’s CPF tax number as both username and password, while the system lacked multi-factor authentication and periodic credential renewal. The account holders had permissions spanning multiple jurisdictions, allowing a single compromised credential to reach millions of phones. An unidentified X user claimed responsibility and posted screenshots and a tutorial, but the attacker’s identity and the full scope of the breach remained under investigation. The Ministry later said the intruder had learned to send alerts through a federal-government course, highlighting failures in access control, credential management, and security training.
