Brazil’s Gov.br faces record DDoS attacks as Serpro insists defenses held

The disclosure followed remarks by Serpro director André Picoli Agatte at a November 4 event, where he described an attack that week as unprecedented. Serpro's subsequent statement emphasized the resilience of its defenses but provided no technical details about the attack's scale. Other government services separately reported authentication problems during the same period.

Serpro reports record attacks but no disruption Speaking at Serpro's AI Week in Brasília, Agatte cited the attack while making the case for greater investment in cybersecurity.

"We have shown resilience and we have shown the capacity to resist," he said.

Serpro's November 5 statement said the attacks caused no interruption or compromise of Gov.br's systems. Yet government records document authentication problems during the same period. Brazil's Council for Financial Activities Control reported that certificate-based authentication integrated with Gov.br was unavailable for some users between November 4 and 5, affecting access to its Siscoaf platform.

Coaf attributed the problem to the certificate chain used for authentication and said service had been restored. The government's eSocial service also recorded instability in its Gov.br integration on November 5. Neither agency linked the disruptions to DDoS attacks.

Serpro has not publicly provided technical details of the attacks or explained their relationship, if any, to the reported authentication problems. Why it matters: one login for public services Figures from Brazil's Ministry of Management and Innovation (MGI) show that, as of October 2026, Gov.br had 179.5 million active accounts and provided access to 5,390 federal digital services and more than 8,700 state and municipal services. It also supported authentication for approximately 4,000 government systems.

Pensions (Meu INSS), healthcare (Meu SUS Digital), the Digital Work Card, Digital Driver's License, Enem exam and Fies student financing run through it, as does an electronic signature used 592 million times. Serpro's role in Brazil's identity infrastructure extends beyond Gov.br. Its AIBio biometric platform supports identity verification, identification and deduplication, drawing on a repository reported to contain 376 million facial records.

The state-owned company also operates Datavalid, which allows businesses to verify identities against authoritative government databases. DDoS attacks do not need to compromise personal data to disrupt public services. An outage affecting Gov.br authentication could prevent users from accessing pensions, healthcare, employment records and other essential government services.

DDoS attacks put identity infrastructure under pressure NETSCOUT recorded 550,550 DDoS attacks against Brazilian targets in the first half of 2025, up 54 percent from the preceding six months. Another 470,000 attacks were recorded in the second half, bringing Brazil's annual total to more than one million. The pressure is growing worldwide.

According to NETSCOUT's latest threat intelligence report, more than 9.1 million DDoS attacks were observed globally in the first half of 2026. Attacks exceeding 1 Tbps or 1 billion packets per second increased 1,286 percent from a year earlier. The threat is changing as well as growing.

Attackers are increasingly targeting connection limits in firewalls, load balancers and other infrastructure rather than simply overwhelming internet links. Residential proxy networks and DDoS-for-hire services can also make malicious traffic harder to distinguish from legitimate users. For centralized identity services, that distinction matters.

A login system can remain online while particular authentication routes become unavailable or unreliable. The risks are not limited to Brazil. A DDoS attack on the Netherlands' DigiD identity service on October 30 disrupted access to government services, generating roughly 4,500 complaints in 90 minutes.

Operator Logius acknowledged the disruption and filed a police report. Serpro invests in DDoS protection In May 2026, Serpro signed a five-year, R$38.4 million contract with NTSEC Soluções em Teleinformática for cloud-based DDoS mitigation. Serpro has not publicly disclosed how the protection performed during the recent attacks.

Questions remain over attack scale Serpro maintains that its defenses protected Gov.br throughout the attacks, but has released no figures on their scale, duration or mitigation. Separate government notices confirm authentication problems during the same period, including a certificate-chain failure affecting Siscoaf, without establishing any connection to the DDoS campaign. As more public services depend on centralized digital identity infrastructure, the incidents underline both the importance of service resilience and the value of transparent reporting when disruptions occur.