The Civil Defense Alert system, known as Defesa Civil Nacional, is designed to warn residents of imminent threats such as floods, landslides, and severe storms. It utilizes Cell Broadcast technology, which sends text and audio notifications directly to compatible mobile phones within a cell tower’s range, bypassing silent mode and requiring no prior registration. Authorities confirmed that at least 10 unauthorized alerts were issued using the system’s highest emergency level, a category reserved for life-threatening natural disasters.
The first unauthorized alert was registered around 11:40 pm on Friday, June 19, in the state of Paraná. Within hours, the emergency sound—which overrides whatever is on a user’s screen—reached phones in São Paulo, Rio de Janeiro, Brasília (Federal District), Bahia, Pará, Mato Grosso do Sul, and Acre. The message displayed on devices read “Defesa Civil: misantropi4,” a leetspeak substitution for the Portuguese word misantropia, meaning misanthropy or aversion to humanity. While no dangerous instructions accompanied the message, the use of the most severe alert category caused recipients to be jolted awake, leading to significant public confusion and panic.
National Secretary of Protection and Civil Defense Wolnei Wolff stated that the alerts were triggered remotely by an individual not part of the national civil defense network. “It’s difficult to say whether one or more people participated in this criminal act,” Wolff said, emphasizing that the incident was “very bad for the system, considering that we are dealing with people’s safety when we issue the alert.” Officials noted that attackers managed to regain access after an initial blocking attempt, forcing the platform to be taken offline entirely at 1:30 am on Saturday.
The total number of affected devices has not been officially disclosed by Brazilian authorities, as the alerts were activated outside official procedures. However, the German news outlet Ad-hoc-News reported an estimate that approximately 30 million people were reached. The four telecommunications operators delivering the service—Algar, Claro, TIM, and Vivo—were involved in the overnight response alongside the National Telecommunications Agency (Anatel). Anatel stated there is no reason for public concern regarding the system’s overall capability, emphasizing its role in saving lives during disasters.
Security experts have pointed to inherent vulnerabilities in Cell Broadcast systems globally. Academic research since 2019 has demonstrated that fake alerts can be transmitted using relatively inexpensive equipment, including software-defined radios, because devices cannot independently verify via cryptographic authentication whether an alert was genuinely sent by civil defense authorities. It remains unclear whether the Brazilian attack exploited the central dispatch platform, as government statements imply, or utilized a clandestine transmitter. The specific vulnerability exploited has not been publicly disclosed, and the investigation is ongoing.
The incident highlights the growing security risks associated with critical infrastructure that relies on broadcast technologies without robust end-to-end encryption. Brazil’s Cell Broadcast system is relatively new; it was mandated by Anatel in 2022, piloted in 11 cities beginning in August 2024, and expanded to cover the entire national territory by October 2025. A person claiming responsibility for the attack has posted on X (formerly Twitter), though no suspect has been formally identified by authorities.
In response, the Ministry of Integration and Regional Development stated that the core Civil Defense Alert infrastructure did not suffer “structural damage.” However, the platform will remain suspended until all digital security conditions are re-established. National Secretary Wolff indicated that a more secure version of the platform is already under development and would be activated as soon as possible. “We are handling the case with the utmost technical rigor. Our commitment is to ensure that the alert systems function with complete reliability, guaranteeing the protection of the Brazilian population,” Wolff said. No timeframe has been given for when the compromised system will be restored to full operation.
