Fundação Carlos Chagas Listed by alphv Ransomware Group

On April 26, 2023, the Brazilian nonprofit Fundação Carlos Chagas appeared on the leak site of the alphv ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the organization, which has conducted civil service exams, college admissions tests, and socio-educational research for more than 55 years. Anyone who has taken a public-sector exam, applied to certain universities, or participated in research studies managed by the foundation may have personal information now in the hands of extortionists.

Reported Details from the Listing

The alphv leak site entry, still accessible via its onion address, claims the foundation suffered a ransomware intrusion in which attackers copied internal files before encrypting systems. The disclosure does not quantify how many records were taken, list specific data types such as names, national ID numbers, addresses, or test scores, or provide a ransom demand. It simply states that internal files were exfiltrated and gives a deadline for payment after which samples or all data would be published. As of the listing date, no further samples had been released on the site, but the threat of full publication remains active.

Why This Matters for You and Your Family

If you or your children have sat for a concurso público, vestibular, or any evaluation administered by Fundação Carlos Chagas, your personal details likely sit inside the stolen files. These records often contain full names, dates of birth, taxpayer IDs, contact information, educational history, and sometimes parent or guardian details. Once exposed, such information fuels identity theft, loan fraud, and targeted phishing for years. Brazilian families are especially vulnerable because the same CPF number used for exams also serves as the key identifier for tax filings, banking, and government benefits.

Doxxing and Identity-Chain Risks

Exposed exam and research records create long identity chains. An attacker who obtains your CPF, email, and phone from the foundation’s files can cross-reference them with credential leaks from other Brazilian services, gaming platforms, and social networks. This mapping quickly reveals household addresses, family relationships, and children’s usernames. Gaming accounts are a frequent target because the same password or email used for a school admission test is often reused on Steam, Roblox, or local Brazilian servers; a single leak therefore cascades into account takeovers, harassment, and further doxxing. Continuous monitoring that links handles to real identities is one of the few practical defenses against these expanding chains.

Alphv Group’s Known Track Record

Public reporting attributes the alphv operation, also known as BlackCat, to a ransomware-as-a-service collective that emerged in late 2021. The group has hit hospitals, schools, manufacturers, and government contractors across North and South America. Their standard playbook involves initial access through phishing or exploited remote desktop services, followed by rapid exfiltration of sensitive files using legitimate cloud storage or file-transfer tools. After encryption they launch a double-extortion campaign: demand payment to decrypt systems and a second payment to prevent data publication. The alphv leak site typically posts victim names, screenshots, and sample documents once negotiations fail. In the case of Fundação Carlos Chagas the listing follows this exact pattern.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you ever used on Fundação Carlos Chagas systems or related exam portals, replace it with a unique passphrase, and secure every account with 2FA through an authenticator app rather than SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which frequently chain back to the same leaked personal details.
• Let remediation specialists handle takedown requests for any exposed documents or broker listings that surface from this incident.

The Fundação Carlos Chagas breach shows how even long-established nonprofit institutions handling sensitive personal and educational data remain targets. A single ransomware listing can place thousands of Brazilian families at risk of identity theft and harassment for years to come. Start your DoxxScan trial today; its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage including children’s gaming accounts give you and your family the clearest path to regain control.