The Rhysida ransomware group has claimed Brazil's Minas Gerais state court as a new victim, in a listing posted on its leak site on 7 November 2026. The Tribunal de Justiça do Estado de Minas Gerais was identified by the Ransomware.live tracker at 13:16 UTC that day, according to reports published on 7 November.

The listing is an unverified claim, not a confirmed breach. Neither report gives details of how the attackers got in, whether court systems were encrypted, what data may have been taken, or whether a ransom was demanded. The court's operational status has not been confirmed either, and the tribunal has not publicly commented on the claim.

The target matters because of what courts hold. A state court processes sensitive legal and administrative records, including case files and personal details of litigants, so a genuine intrusion there would carry serious privacy and operational risks. That is why the listing has drawn attention even though nothing has been independently confirmed.

Rhysida has listed a string of new victims in recent days, including organisations in Switzerland and the United Kingdom, and the Minas Gerais claim was reported on the same day as a separate Qilin claim against Brazilian drug firm Roxfarma. Defenders should watch for indicators linked to Rhysida, keep backups tested, and treat the court listing as an allegation until the tribunal or investigators confirm what happened.

[Source: qpulse.quasarcybertech.com](https://qpulse.quasarcybertech.com/news/7989/rhysida-ransomware-group-claims-attack-on-tribunal-de-justica-do-estado-de-minas-gerais) | [Source: cyberthreatintelligence.net](https://cyberthreatintelligence.net/ransomware-victim/tribunal-de-justica-do-estado-de-minas-gerais-rhysida-2026)