Hacker Claims to Leak Data from Brazil’s Mato Grosso Court

A threat actor has claimed that data from Brazil’s Mato Grosso Court of Justice was leaked online. The Tribunal de Justiça de Mato Grosso, or TJMT, operates the judicial system in Mato Grosso. The actor made the claim on an underground forum and offered the alleged data for download.

Threat Actor Claims Court Data Was Leaked

According to the post, the leaked material totals about 113 MB of case-related data. The post claims the actor extracted the files from systems linked to the Mato Grosso Court of Justice.

It also suggests that getting the data was relatively easy. However, the post does not explain how the actor allegedly gained access. It does not name a security flaw, stolen account, or specific attack method.

The account behind the post also appears to be newly created. It has no established reputation on the underground forum, based on the information provided. That makes the claim difficult to assess without further evidence.

No independent cybersecurity researcher has confirmed that the files came from TJMT systems. There is also no independent confirmation that the files contain genuine court records. Searches for coverage did not find a major Brazilian news outlet reporting the same 113 MB claim.

No cybersecurity publication or researcher was identified as independently confirming the allegation. As a result, the underground-forum post remains the source of the claim.

TJMT had Already Added New Security Measures

The claim appeared as TJMT was taking steps to strengthen the security of its digital systems. On May 26, the court announced a visit from Brazil’s National Council of Justice, CNJ. The visit introduced the Justiça [+ Segura] cybersecurity program at the court.

The program focuses on stronger cybersecurity across Brazil’s judicial system. It also covers the protection of digital records and the integrity of judicial information. TJMT said digital growth has brought major benefits to the courts and their users.

However, the court also noted that digital services can increase exposure to cyberattacks.  TJMT had also introduced multi-factor authentication for its electronic court system. The measure applies to the Processo Judicial Eletrônico, known as PJe.

The court began the rollout in May and made the new login method mandatory. Users must provide their normal login details and a temporary code. The code comes from an authenticator app on a mobile device. TJMT said the extra step helps protect institutional information and digital services.

The court also said PJe handles personal data and confidential case information. Those records require stronger protection against unauthorized access.

The new system aims to make access harder when someone obtains a user’s password. TJMT later confirmed that the new MFA system took effect on May 18. The court described the change as an added security layer for PJe users.

Alleged Exposure Still Needs Confirmation

The security measures provide context around the claim, but they do not confirm a breach. TJMT’s public announcements about cybersecurity do not confirm the alleged 113 MB leak. The available information also does not establish whether TJMT infrastructure was compromised. It remains unclear what the alleged dataset contains.

It is also unclear how many court cases or people could be involved. The alleged files could contain different types of case-related information.

However, the available material does not establish their exact contents or sensitivity. The claim should therefore remain classified as an unverified data-leak allegation. Independent analysis would be needed to establish whether the files are genuine.

Confirmation would also be needed to determine whether they came directly from TJMT systems. The source of the alleged access also remains unknown.

There is no information identifying a compromised account, software flaw, or attack technique. There is likewise no confirmed figure for affected individuals or court cases.

For now, the underground-forum post is the only reported source for the alleged 113 MB exposure. Further confirmation from TJMT, Brazilian authorities, cybersecurity researchers, or independent analysis would clarify the situation. Until then, the alleged leak cannot be treated as a confirmed breach of the Mato Grosso Court of Justice.

The TJMT claim follows a pattern of alleged Brazilian data exposures appearing on underground forums. A separate threat actor has claimed to be selling 104 million vehicle records, part of the largest data leak in Brazilian history that exposed 223 million individuals.