Data from the Security Leaders incident panel shows that attacks on Brazilian municipal governments nearly doubled in a year, and the São José do Rio Preto case shows the real cost of treating cybersecurity in smart cities as optional.
In 2025, a Brazilian city government spent six days running on paper. The ambulance service, the municipal guard, the 153 emergency line and the health units kept working, but without systems: every case logged by hand, every dispatch made by phone, while the operators behind the attack demanded a ransom in bitcoin. It was not an isolated incident or a stroke of bad luck. It was the visible consequence of a pattern that now has a number: 26% of the cyber incidents recorded in Brazil in 2025 targeted municipal administrations, according to the Security Leaders Incident Panel. A year earlier, that share was 14%.
The remaining question is not whether another city government will be attacked, but when, and whether it will be ready. And the answer does not depend on luck. It depends on a design decision made long before any attack happens: how the city network was built, and what it allows or prevents when any single point is compromised.
The jump the numbers were hiding
The Security Leaders Incident Panel, published on 23 January 2026, recorded 92 cyber incidents against the public sector in 2025. Of those, 25 targeted municipal administrations, the equivalent of 26% of the total. In 2024, the same panel had counted 70 incidents, of which only 10 targeted municipalities, or 14%.
The jump from 14% to 26% in twelve months is not statistical noise, it is a trend. Municipal governments have stopped being an occasional target of cybercrime and have become a structural one: one in every four attacks recorded in the country today has a municipality on the other end. It is worth noting that the same panel also documented, over the period, DDoS attacks against federal bodies such as the STJ and the TRF-3, as well as critical infrastructure including Guarulhos Airport, attributed to a single actor identified by the Federal Police, and an attempted attack against the city government of Poços de Caldas (MG) in early 2026, with no confirmed data leak so far. The pattern is not restricted to one case: it is a wave hitting different layers of the public sector, with municipal governments accounting for most of the recent growth.
The reason for the jump is easy to state and hard to solve: connected cities have grown in sensors, cameras and automation systems far faster than they have grown in cyber defense. Every new smart traffic light, every monitoring camera, every traffic sensor is also a potential new entry point. When the network infrastructure does not keep pace with that growth through segmentation and visibility, the attack surface expands quietly, incident after incident, until the day the attack lands.
This growth in exposure is not exclusive to the public sector. Market data published in September 2026 shows that August of that year recorded 27 ransomware attacks in Brazil, the highest monthly figure of the year, placing the country among the most affected in the world. The sectors with the sharpest growth in the period were precisely those that combine information technology systems with operational automation: energy, with a significant jump in the number of cases, manufacturing and healthcare. It is the same exposure logic that reaches cameras, sensors and traffic lights in a connected city, replicated in power plants, factories and hospitals. The underlying pattern is always the same: IT and OT converging with no security barrier between the two layers.
What happens when the attack arrives: the São José do Rio Preto case (2025)
The Erione and Fortinet panel at Innovation Week 2026, titled “Is your city smart enough not to be hacked?”, used the 2025 attack on the city government of São José do Rio Preto as a concrete picture of that risk. The case matters not for the volume of leaked data or the size of the ransom, but for what it reveals about what happens when an entire city depends on systems that stop working all at once.
Six days of a city on paper
For six days, essential city services operated without the digital systems that support them. The ambulance service, the municipal guard and the 153 line, along with the basic and emergency health units, kept serving the population, but with manual records and improvised communication. It is the kind of scenario where technology meant to speed up service suddenly becomes the reason it gets slower and more prone to error.
Consider what an emergency dispatch without an integrated system means in practice: the 153 operator takes the call but has no access to the address history, to the real-time location of available vehicles, to the digital protocol that normally guides triage. Every step that used to take seconds now depends on someone writing it down, calling, confirming by phone. In health and public safety services, that kind of delay is not an administrative inconvenience, it is a direct risk to the life of whoever is waiting.
The bitcoin ransom demand and the real cost of having no contingency plan
The attack included a ransom demand in bitcoin, a typical ransomware practice. More than the amount demanded, the real cost was in the shutdown: six days without systems in services that cannot stop represents a direct risk to the continuity of care for the population, not merely financial or reputational damage.
That is the point usually missing from the conversation about cybersecurity in the public sector: the risk calculation cannot be limited to “what would it cost to pay the ransom” or “what would it cost to recover the data”. The correct calculation is “what does it cost for an essential service to go six days without systems, with no return date, in a city that depends on it every day”. That number rarely shows up in a budget, but it is the one that should drive investment priority in network security.
Cybersecurity in smart cities: more nerves, no immune system
The metaphor used in the Erione and Fortinet panel sums up the diagnosis well: smart cities have gained “more nerves”, meaning more connected sensors, cameras and automation points, without developing the equivalent “digital immune system”, the ability to detect, isolate and respond to a threat before it spreads.
The metaphor works because it describes precisely what happens in a biological body and, by analogy, in an urban network. An organism with more nerve endings does not automatically become healthier, it becomes more sensitive to stimuli, harmful ones included. Without a proportional defense system, every new nerve is also a new path along which an infection can spread. A city that multiplies connected points without multiplying defense follows exactly that logic: more sensitivity, more exposure, no additional barrier.
Devices still running factory passwords
One of the points raised in the talk is recurrent in connected urban infrastructure projects: IoT devices such as cameras and sensors installed and operating still with the factory password. It is the simplest door of all, and it is still being used.
This kind of flaw demands no technical sophistication from the attacker. There is no need to exploit a complex software vulnerability when the manufacturer already publishes, in the manual, the default password for thousands of identical devices installed across different cities. A recent survey, also identified while tracking the sector, showed how misconfigured public servers, in this case tied to more than twenty Brazilian city government and police station portals, were compromised through malicious server modules that redirected traffic to fraudulent pages, without the intrusion being noticed for months. The attack used no exotic technique: it took advantage of default configuration and the absence of continuous monitoring, the same kind of basic flaw that the factory password represents in IoT devices. The lesson common to both cases is that much of the cyber risk in public infrastructure does not come from sophisticated attacks, it comes from basic configuration nobody reviewed.
Cameras and the financial system on the same network: the absence of IT/OT segmentation
The second point is structural. In many projects, the monitoring camera network, the traffic sensors and the city government financial system share the same network fabric, with no segmentation between information technology (IT) and operational technology (OT). In practice, that means an attacker who compromises a poorly configured camera can, from there, reach critical systems that have nothing to do with urban surveillance. It is this absence of an internal barrier that turns a small point of failure into a citywide incident.
To understand why this happens, it helps to separate the two worlds that are usually treated as one. Information technology, or IT, is the layer of administrative, financial, data and communication systems: payroll, tax collection systems, corporate email. Operational technology, or OT, is the layer that controls physical equipment: cameras, traffic lights, traffic sensors, public lighting systems, industrial controllers. Historically, these two worlds were physically separate, different networks, different equipment, different teams. The connected city merged everything into a single network infrastructure to cut cost and simplify operations, but it rarely reproduced, inside that unified network, the security separation that existed before.
The result is a flat network, where any device can, in principle, communicate with any other. A traffic monitoring camera, technically a low-criticality OT device, sits on the same logical segment as the server that processes payments and taxpayer data, a high-criticality IT asset. Compromising the camera today is technically simple: outdated firmware, default password, unencrypted communication protocol. From there, with no segmentation, the path to the financial system is open. It is this design, more than any specific software vulnerability, that turns a small flaw into an incident that shuts down an entire city.
The way forward: security designed into the project, not patched on later
Network segmentation and per-device visibility have stopped being a technical differentiator and become a prerequisite for keeping public services running. Segmenting means isolating networks by function and criticality, so that compromising a camera does not open a path to the financial system or the health system. Per-device visibility means knowing, in real time, what every connected piece of equipment is doing on the network, rather than finding out only after the attack.
In practice, for a public manager evaluating a connected city project, new or already in operation, that path runs through a few concrete steps.
First, map what is already connected. Before any security decision, you need a real inventory of every device on the municipal network: cameras, sensors, traffic light controllers, lighting systems, administrative servers. Much of what goes wrong in urban infrastructure happens precisely because nobody has that complete map, and a device installed years ago, forgotten, with outdated firmware, stays connected and vulnerable without the IT team knowing it exists.
Second, separate networks by criticality, not by convenience. The camera network does not need to, and should not, sit on the same logical segment as the financial system. The traffic light network does not need to sit on the same segment as the administrative network. Segmenting means designing the architecture so that each criticality layer has its own fabric, with clear rules about what can and cannot communicate between them.
Third, eliminate default configurations before putting any device into production. Every camera, every sensor, every controller entering a municipal network should go through a mandatory process of credential replacement and firmware update before activation. It is a simple, low-cost step that closes the entry point most used in attacks on urban infrastructure.
Fourth, implement continuous monitoring, not periodic checks. Per-device visibility is not a monthly report, it is a system that watches network behavior in real time and flags any anomaly, such as a device that starts communicating with a system outside its normal scope.
There is a fifth piece, less discussed but equally decisive: detection time. The faster an anomaly is identified, the less room there is for an isolated incident to become a multi-day shutdown. Treating that time as a management metric, rather than a technical detail, is what separates a prepared city from one that only discovers its vulnerability when it is already too late. A public manager who tracks operational indicators should track, with the same regularity, the average time their network takes to identify activity outside the normal pattern.
None of these fronts works well when added after the project is already live. Security that comes in as a patch costs more and covers less than security designed into the network from the start. Redesigning segmentation on a network already in operation, with hundreds of active devices and services that cannot stop, is a far more complex undertaking than designing that same segmentation before the first camera is installed.
Erione: connected city infrastructure with native defense
It was exactly this diagnosis that Erione took to the stage at Innovation Week 2026, alongside Fortinet, to publicly discuss the risks and the defense paths for connected cities. As an integrator of smart city projects, Erione applies network segmentation and per-device visibility from the architecture stage, not as an extra layer added after cameras, sensors and systems are already installed and running.
That means that in a new project, the separation between IT and OT networks is part of the initial design, not a later revision. It also means that every device, from the camera to the traffic sensor, goes into production with its own credentials and active monitoring, not with the factory default configuration. The logic is simple: a connected city without cybersecurity in smart cities designed from the outset is not a smart city, it is an attack surface with good intentions.
What comes next
The movement seen in municipal governments is not exclusive to the public sector. Other critical infrastructure sectors, such as energy and manufacturing, have also been recording significant growth in cyber attacks in Brazil, a sign that the same exposure logic, more connectivity without proportional defense, repeats across different fronts. Sectors that depend on convergence between administrative systems and industrial automation systems face, today, the same dilemma a city government faces when it connects cameras and traffic lights to the same network that processes payments.
For public managers, the decision is no longer whether it is worth investing in network segmentation and visibility, it is how much it costs to postpone that decision until the next incident. Every month without segmentation is one more month of accumulated exposure, on a risk curve that, according to the sector own data, only rises.
Conclusion
If one in every four cyber attacks in Brazil already targets a city government, the network security of a connected city project cannot keep being treated as an add-on. The São José do Rio Preto case shows the concrete cost of treating security as a patch: six days of a city on paper, essential services held together by pen and telephone. The same exposure logic appears in government portals compromised by basic configuration and in sectors such as energy and manufacturing, where convergence between administrative and operational systems grows faster than the corresponding defense.
Network segmentation, per-device visibility and detection time are not technical checklist items, they are what decides whether the next incident becomes a contained alert or a multi-day shutdown. And that decision is made long before the attack, at the moment the city network is designed.
Assess the security design of your urban infrastructure with Erione, starting from the same technical diagnosis presented in the Erione and Fortinet panel at Innovation Week 2026.
