The unauthorized messages appeared as “extreme” level alerts, a category reserved for severe threats. Devices in the southern state of Paraná received the initial transmission, followed minutes later by alerts in the major metropolitan areas of São Paulo and Rio de Janeiro. The message displayed the word “misantropi4,” an alphanumeric substitution of the Portuguese word “misantropia” (misanthropy), which translates to hatred toward humanity. The use of numbers in place of letters, commonly referred to as leetspeak, is a technique frequently associated with cyberattacks. In addition to the Cellbroadcast alerts, residents in São Paulo and Rio de Janeiro reported receiving similar messages via standard SMS.
The Cellbroadcast system functions similarly to the United States’ Wireless Emergency Alerts (WEA), allowing authorities to broadcast short emergency texts directly to mobile devices within specific geographic zones, regardless of the user’s phone number or network provider. The platform is managed by Anatel, the National Telecommunications Agency. Following the incident, Anatel temporarily disabled the tool to investigate the breach. CNN Brasil contacted Anatel for comment but did not receive a response prior to publication.
State-level civil defense agencies in affected regions have confirmed that no official alerts were issued by their personnel. The São Paulo Civil Defense stated there is no record of any incident justifying an extreme alert and has contacted Anatel and other involved institutions to investigate the origin of the message. Similarly, the Paraná state government noted that no severe events were forecast for Curitiba and that the alert was not triggered by state authorities. The Rio de Janeiro Civil Defense attributed the message to instability in the IDAP/Cellbroadcast sending system, emphasizing that no official alert was issued due to a lack of at-risk natural disaster conditions. All three agencies confirmed they are monitoring the situation in coordination with federal bodies.
The National Civil Defense has not yet announced a timeline for restoring the alert tool, stating that the platform will remain offline until all security conditions are reestablished. The investigation into the origin of the unauthorized transmission is ongoing, with no confirmed details regarding the specific vulnerabilities exploited or the identity of the actors responsible.
2 Comments