Brazil's Gov.br platform faced the largest volume of distributed denial-of-service (DDoS) attacks in the history of Serpro, the state-owned company that runs its infrastructure, but the service stayed online and no data was compromised, according to the company. The information was disclosed on Thursday, November 5, 2026, and echoed through the week.
Read also: Japão anuncia pacote emergencial de cibersegurança de ¥10 bilhões após onda de vazamentos de dados
What Serpro's director said
The revelation came from André Picoli Agatte, Serpro's director of New Business and IT Intelligence, at the opening of the II Serpro Artificial Intelligence Week, held November 4–6 in Brasília and streamed live on YouTube, with the company's president, Wilton Mota, in attendance. Agatte was speaking about digital sovereignty and infrastructure investment when he mentioned the episode.
“This week we had an unprecedented attack on GovBR, on our structures, and we have managed to respond. We have shown resilience and shown the capacity to resist,” the director said.
Editorial classification: the phrase “unprecedented attack” is a statement by Agatte. He did not say what kind of attack it was, which systems were targeted, how long it lasted, or whether there was damage. Agatte leads the commercial area; the executive responsible for system availability and incident response is the Operations directorate, which only spoke later, in the official note.
What Serpro's official note says
On the same day, November 5, Serpro published a clarification. According to the text, “over the last semester” the company's infrastructure “recorded the largest volumes of distributed denial-of-service (DDoS) attacks in its history.” The company says its security and incident-response team acted “promptly, applying rigorous mitigation and defense protocols” and that “there was no impact, interruption or compromise of any kind” in Gov.br's environments, which are monitored 24 hours a day.
Operations director Wallyson Oliveira said in the note that the teams acted “in a coordinated way, using advanced monitoring, detection and mitigation mechanisms” and that everything happened “without impact on the availability or integrity” of the systems. President Wilton Mota added: “We will keep investing in security, intelligence and digital sovereignty to guarantee the continuity and reliability of digital public services.”
A DDoS is not a breach
A DDoS attack is a flood of fake requests, usually fired by thousands of infected computers and devices, to slow a service down or take it offline. On its own, it does not open any database or steal passwords: the target is the server, not the phone of the person using the app. The note itself defines the attack as having the “exclusive objective” of “making digital environments unavailable by overloading access.”
The size of the target
According to the Ministry of Management and Innovation in Public Services (MGI), which coordinates the platform, Gov.br had, as of October 2026, 179.5 million active accounts, 5,390 federal digital services and 4,000 systems integrated into the single login. Through the same login, citizens also reach more than 8,700 state and municipal services, such as Meu INSS, Meu SUS Digital, the Digital Work Card, the Digital Transit Card, Enem and Fies. Electronic document signing has already been used 592 million times. A successful DDoS against authentication would freeze, at the same time, benefit requests, vaccine appointments and university entrance registrations. According to Serpro, that did not happen.
What has not been explained yet
The note does not single out the episode cited by Agatte, and it discloses no traffic volume, duration, origin or authorship. No group has claimed the attack. There is also a framing gap: the director spoke of an attack “this week,” while the note speaks of record volumes “over the last semester.” Serpro has not said whether it will publish technical data on the attacks, such as traffic peaks and duration. Until it does, the “unprecedented” claim remains without a number.
The 2024 precedent
The government has already seen what happens when the defense fails. On September 11, 2024, a DDoS attack claimed by a hacker identifying as @azaelx64 left Gov.br unstable and briefly took down the pages of the Planalto Palace and of ministries such as Justice, Foreign Affairs and Agriculture, as well as Anatel. Most sites were back by around 4:15 p.m., and Serpro acknowledged the problem and opened an investigation.
What users should do
Because Serpro says no account was compromised, there is no re-registration to do. News of an “attack on Gov.br” often becomes phishing bait in the following days, so it is worth doing this: enable two-step verification in your Gov.br account's security settings; access it only by typing gov.br in the browser or through the official apps, never via a link you received; and ignore SMS, email or WhatsApp messages asking for a “security update,” password or code in the name of Gov.br.
Image: facade of Serpro's headquarters in Brasília. Credit: Disclosure/Serpro.
Sources
- TekiMobile — Ataque hacker ao Gov.br: Serpro nega vazamento de dados e queda
- Convergência Digital — Serpro: maior volume de ataques DDoS da história, sem impacto no Gov.br
- SindPD — Gov.br sofre ataque cibernético ‘sem precedentes’, afirma Serpro
- Capital Digital — Serpro revela “ataque sem precedentes” ao Gov.br
Transparency: this article was produced with the help of artificial intelligence, from cross-checking public posts and internet sources, and reviewed against the original sources cited below. We recommend consulting the original sources for more details.
Muse
