An investigation by Fantástico, TV Globo's Sunday night newsmagazine, exposed a clandestine digital market that sells the usernames and passwords of public servants and officials with access to government and private systems. According to G1, the offers ranged from lookups of income tax records for around R$ 100 to a service that altered court files and removed an arrest warrant for R$ 1,000. Reporter Mônica Marques spent a month following the negotiations in chat groups and online forums.
What is for sale are other people's keys. Each login belongs to an official whose position opens protected digital doors, and the price rises with the account's power: access to the security secretariat of the southern state of Paraná went for just over R$ 100, with a driver's name, chassis, engine and photos for R$ 110, while a login to the court system of Santa Catarina state was advertised at R$ 500. Sellers also offered so-called painéis, or panels, systems that pool illegally obtained data, from online purchases to health and vaccination records. The business model is blunt: the service costs a fraction of what the buyer gains. One seller offered to erase a traffic fine for half its value, and others promised to plant an infraction in someone else's name at Detran, Brazil's state motor vehicle departments.
Tested and confirmed
The program took the material to prosecutors in Rio Grande do Sul, who were already investigating these groups. With authorization and security safeguards, the Extreme Violence Prevention Unit tested how far the credentials would go. "We found that it works", said Fábio Costa Pereira, a senior state prosecutor. "What they promise, they can actually do." Prosecutor Leonardo dos Santos Rossi said the sale of credentials had already surfaced in earlier complaints and investigations: "these sales of passwords really do work, they are real".
In the central state of Goiás, the problem has moved beyond data dealing. According to G1, the state court identified 350 fraudulent accesses, and one police operation uncovered about 140 tampered entries in the Banco Nacional de Mandados de Prisão, the national arrest warrant database. Those were warrants with wrong information that could send an innocent person to jail. A couple was arrested and is now answering the charges in freedom. "Credentials taken from civil servants or from the magistrates themselves have been used to defraud, insert, alter or delete, including arrest orders in the national databases", said police delegate Sabrina Leles of the Goiás Civil Police. A fraudulent blocking order issued in the state targeted a young woman who told the program she had entered this world as a teenager, was blackmailed into producing intimate images and was later stalked offline.
What we still don't know, and what to watch for
One of the main networks in this market goes by The Com. It works as a web of interconnected communities spread across several countries, with no central site, according to the program. The FBI has warned that many members are very young, and the stolen data feeds other crimes, such as sextortion, blackmail with intimate images. In Belém, in the northern state of Pará, a Civil Police investigation that began with complaints of illegal data exposure led to the arrest of a woman caught sharing content of sexual violence against children and teenagers. Delegate Vanessa Lee said those under investigation sold logins and took part in other practices, including arms sales and groups linked to suicide. The Pará police worked with researchers from a federal university.
What we still don't know: the real size of the market. The report gives no estimate of how many credentials are circulating or how many people have been affected, and the only consolidated tally, from Goiás, covers a single state. It is also unclear how the passwords were taken, whether through scams, malware or insider help, and which systems have since been fixed. So far this is one broadcaster's investigation, though it rests on tests by state prosecutors and on official probes in at least three states.
The practical takeaway: distrust any offer to erase fines or solve court matters outside official channels, and any "court order" notice that arrives on a messaging app. If you work in the public sector, treat your password like a physical key and turn on two-factor authentication wherever the system allows. And with teenagers at home, stay alert to unknown contacts and abrupt behavior changes, signs the police link to sextortion.