Brazil arrests alleged Lapsus$ hacker

Authorities in Brazil have made what they believe is a key arrest in their effort to dismantle the notorious Lapsus$ hacking group.

A translated press release from the country's federal police announced Wednesday that the unnamed individual will face at least five criminal charges related to the operation of the group and its various attacks.

The arrests could mark a significant development in the fight against the Lapsus$ crew as police believe the person they apprehended to be the "main Brazilian suspect" in the country. While Lapsus$ is an international outfit, threat analysts have long suspected the group's base of operations might be in Brazil.

Bursting onto the scene earlier this year, Lapsus$ has made a reputation for itself with high-profile network breaches at the likes of Microsoft, Okta, Cisco, Uber and Nvidia.

Unlike other cybercrime groups, which have tended to keep their conquests private in hopes of collecting ransom payments, Lapsus$ instead boasted of its hacks in apparent hopes of grabbing headlines and boosting its underground reputation. The crew earned itself a reputation within underground cybercrime circles for reckless and immature behavior.

In announcing the arrest, Brazilian authorities did not cite any of those high-profile international attacks. Rather, they said the alleged criminal hacker will face charges for a series of attacks that occurred months before Lapsus$ emerged as a known threat group.

The first attack occurred in December 2021 when Brazil's Ministry of Health had its network breached and internal data copied, including some related to the National Vaccination Certificate website.

Later, the Lapsus$ crew was involved in attacks on Brazil's Empresa Brasileira de Correios e Telégrafos, which runs the country's postal service, and Localiza Rent a Car. From there, the group went international with the high-profile attacks.

Charges for the hacker include invasion of a computer device; interruption or disturbance of telegraphic, radiotelegraphic or telephone service; money laundering; corruption of minors; and organized crime.

Police did not say whether the alleged hacker could also face extradition for further criminal charges abroad.

This is not the first arrest connected to Lapsus$. In April, police in the U.K. announced the arrest of two minors for their alleged roles in multiple Lapsus$ attacks. The two teenagers were each hit with charges of unauthorized access.