Messages obtained by the Federal Police reveal that banker Daniel Vorcaro had early access to confidential procedures by the Federal Public Ministry (MPF) that investigated irregularities in the attempted purchase of Banco Master by Banco de Brasília (BRB).
According to a report sent to the Federal Supreme Court (STF), restricted data was extracted directly from the MPF systems by Vorcaro's allies before the launch of Operation Compliance Zero.
The investigations supported the decision of STF minister André Mendonça, who ordered Vorcaro's second arrest.
According to the investigations, "The Gang" — a group under the banker's command focused on threats and espionage — carried out illegal consultations in restricted databases belonging to police investigation and public security bodies.
According to the PF, the extractions were coordinated by Luiz Phillipi Mourão, appointed as the group's operational head and known by the code name "Sicário".
'I want everything', said Vorcaro
According to the investigation, on July 23, 2025, Sicário sent Vorcaro the results of a search carried out in the MPF's internal systems using the parameters "BRB AND MASTER", with the purpose of mapping findings on the financial operation between the two institutions.
In the exchange of messages, Sicário sent a message, from an unknown sender, which warned about the number of records and the risk of attracting the attention of control bodies:
Sicário [in a message sent to Vorcaro]: "Check with him [Vorcaro] if he wants us to enter into all the processes regarding BRB + Master. There are many. I entered the first one, but there are many and sometimes it can attract attention."
Daniel Vorcaro [in response to Sicário]: "I want everything. Undivided attention."
Sicário [in response to Vorcaro]: "Yes! Then I'll have it pulled generally. Ok."
The PF found that the query was carried out using the functional login of a Federal Public Ministry server. On the same day, a parallel search, carried out using Vorcaro's CPF number as a parameter, located 15 procedures, 11 of which were under judicial secrecy.
The experts also identified that, in one of the reports sent to the banker, the server's name and capacity had been digitally covered by a "white hatch".
The concealment attempt failed: the metadata continued to be preserved in the PDF file and was fully recovered by federal experts.
The milestone of Operation Compliance Zero
The following day, July 24, 2025, Sicário passed on to the banker the content of a Notice of Fact established at the MPF of the Federal District to investigate alleged crimes against the financial system in the negotiation between Master and BRB:
Sicário: "Investigation to determine irregularities in the purchase Ref. Master + BRB."
According to the Federal Police, this Fact Report constituted the formal starting point of Operation Compliance Zero, which months later would culminate in Vorcaro's arrest. With the breach in the system, the group became aware of the investigation in its first acts.
'We have full access', said Sicário
The PF report points out that institutional espionage had been occurring at least since the first half of 2024.
On June 18, 2024, after receiving a dispatch from Vorcaro from the Office for the Repression of Corruption and Financial Crimes (Delecor), of the São Paulo PF, Sicário activated his network of contacts:
Sicário: "What do you want them to do? I just called the group here."
Then, he sent a survey with confidential procedures involving the businessman. The documents, according to the expert, were generated from the account of a Federal Public Ministry employee.
Upon discovering the existence of six confidential processes bearing his name, Vorcaro ordered:
Daniel Vorcaro: "We all have to get up. To see what it is. DF I didn't know anything."
Sicário: "Yes, I already asked to make the total for everyone."
Three days later, on June 21, 2024, Mourão sent police inquiries and offered to extend the searches to partners and executives — citing names such as Fabiano Zettel, pastor and businessman linked to Vor; Henrique Vorcaro, father of the former banker; Maurício Quadrado, former director of Master; and Nelson Tanure, investor and businessman:
Sicário: "If you want to add more people. To pull the confidential ones."
Sicário: "If you have any more information to add on a name, company or person that I don't know about."
Sicário: "Let me know and send me to pull it. Give me an update, if you want anything."
Sicário: "To pull whatever you need, we have full and unlimited access there, I just don't know for how long."
Circumventing maximum secrecy
Months earlier, in March 2024, the dialogues already registered attempts to break through security barriers at the Prosecutor's Office. On March 23, Sicário reported technical difficulties in reading a specific investigation:
Sicário: "They don't allow it, only their unit, they have placed maximum secrecy."
Sicário: "Tomorrow morning, I'll try to access it, as they are now offline in the system."
The following morning, March 24, the leader of the group "A Turma" celebrated the breaking of the blockade:
Sicário: "Full access max level".
The image attached to the message confirmed entry into the procedure with the credentials of an MPF server.
Using server credentials
In the opinion, the PF emphasizes that the recurring use of logins from a server and an MPF server does not prove, in itself, that the servers had knowledge or voluntary participation in the data leakage scheme.
The report records that the credentials were repeatedly exploited to violate the custody of the investigations, noting that the extractions may have occurred "with or without conscious participation" of the holders of functional access, a hypothesis that remains under investigation.
