A report by Fantástico exposed the existence of an illicit market dedicated to selling stolen logins and passwords, enabling access to both governmental and private systems. The services offered in this market include manipulating judicial processes, canceling fines, and even altering arrest warrants.
Over the course of one month, the story tracked forums and groups used by criminals to negotiate server and authority credentials. Part of these accesses was validated by the Public Prosecutor's Office and confirmed its functionality.
The offerings cover credentials and so-called 'panels,' which consolidate illegally obtained data. Available queries involve areas such as Income Tax, health records, online purchases, employee information, and vaccination data.
The cost varies depending on the target system and the buyer's purpose. The report registered advertisements that reached the Public Prosecutor's Office of Rio Grande do Sul, which was already investigating these activities. With permission and security, investigators tested some of the credentials and confirmed: 'We noticed it is functional. What they promise, they can deliver,' stated Fábio Costa Pereira, a prosecutor from Rio Grande do Sul.
In Goiás, investigations revealed approximately 140 modifications to the National Arrest Warrant Database. Inserting incorrect data into judicial orders can result in the wrongful imprisonment of innocent individuals. The Court of Justice of Goiás identified a total of 350 fraudulent accesses, and there was one case where a false blocking order was issued in the state.
Credentials obtained from servers or magistrates were used to defraud, insert, modify, or delete arrest orders in national databases. Sabrina Leles, a police chief from the Civil Police of Goiás, testified to Fantástico.
A couple suspected of participating in these intrusions was arrested, but both remain free while responding to the process. The network called The Com groups together criminal communities dispersed globally. According to the FBI, many members of this network are young. In these circles, personal data and stolen credentials are used not only for intrusions but also for scams, blackmail, and sextortion.
It was this type of practice that attracted the attention of the Civil Police of Pará. In Belém, investigators located groups involved in the trade of logins and passwords and other criminal activities. To monitor the circulation of this information, the police collaborate with researchers from the Federal Rural University of the Amazon (UFRA), who monitor databases exposed on the internet.
The volume of discovered data illustrates the magnitude of the problem: in 2026 alone, the project identified 18 billion exposed data points, including information that could fall into the hands of criminals and fuel new intrusions.
On the morning of June 20, an alert issued by the Civil Defense reached almost all of Brazil with the word 'misanthropy,' a term meaning hatred of humanity. This message was sent by an intruder using logins and passwords belonging to two firefighters from Pará. The same word was found in conversations monitored by Fantástico. For investigators, this choice could incite the curiosity of adolescents, leading them to seek out communities associated with these groups. This incident highlights the danger of legitimate credentials being improperly appropriated. It is essential to increase vigilance regarding passwords, logins, and links, as tools such as multi-factor authentication and access control help prevent such intrusions.