THREATS
Chile and Guatemala hospitals hit by ransomware
Direwolf posted Chile’s Hospital Clínico Universidad de Chile and Guatemala’s Incán. The Guatemala case disrupted radiotherapy for 194 patients.
Sep 5, 2026 · 2 min
Threats — News
Up-to-date cyber intelligence coverage. Filter by category or browse the full archive.
THREATS
Latin America: attacks hit Mexico
Unit 42 found active campaigns against transport, government, water and finance in Mexico, Ecuador
Sep 5, 2026 · 3 min
THREATSUnited States
Ransomware Hits Mexico and US in LATAM
KRYBIT, EMPERADOR, THEGENTLEMEN and INCRANSOM added victims in Mexico and the United States, with signs of regional expansion.
Sep 4, 2026 · 3 min
THREATS
THEGENTLEMEN adds victims in Mexico
Security Arsenal logged 16 THEGENTLEMEN victims in 24 hours, with cases in Mexico, Brazil and Argentina and 31% in Latin America.
Sep 4, 2026 · 2 min
THREATSUnited States
Greenberg Traurig cited in leak reports
Greenberg Traurig appeared in multiple leak posts, but there is no official verification of a breach or of who was behind it.
Sep 4, 2026 · 2 min
THREATSColombia
Colombia Leads Fraud Reports by Text Messages
In Colombia, 71% faced at least one fraud attempt in the past year, and 82% say these cases are increasing.
Sep 3, 2026 · 3 min
THREATSPeru
Peru Leads Digital Fraud in Regional Surveys
Experian found 73.5% of Peruvians faced at least one digital fraud attempt and 88% say these attacks have increased.
Sep 3, 2026 · 4 min
THREATSParaguay
Paraguay warns of Tekoporã phishing site
MITIC warned about a fake Portal Paraguay site targeting Tekoporã users for personal data. The Banco Atlas case also remains active.
Sep 3, 2026 · 3 min
THREATSChile
Chile warns of bank scam using RUT
Criminals are using Chilean RUT numbers to block bank accounts, impersonate bank staff and steal verification codes.
Sep 3, 2026 · 2 min
THREATS
BREEZE COMET Expands Attacks on Brazil Payments
BREEZE COMET is hitting financial and payments firms in Brazil and running hundreds of fraudulent transactions in 24 to 48 hour bursts.
Sep 3, 2026 · 5 min
THREATSUnited States
U.S. corrects QTFY cyberespionage notice
The Justice Department said several named agencies were targets, not confirmed victims, in a campaign attributed to QTFY.
Sep 3, 2026 · 3 min
THREATSUnited States
KRYBIT and LOCKBIT5 Add New Victims
KRYBIT, LOCKBIT5, and INC Ransom added new victims, with most activity centered on the United States and fresh listings in 48 and 24 hours.
Sep 2, 2026 · 3 min
THREATS
KRYBIT Hits Brazil and Guatemala in 48 Hours
KRYBIT named 13 victims in 48 hours, including cases in Brazil and Guatemala. Health, agriculture, retail and finance were among the targets.
Sep 2, 2026 · 3 min
THREATSBrazil
Oportunidados appears on Direwolf leak site
Brazil's Oportunidados was listed on Direwolf's leak site, according to ransomware trackers and a threat intelligence alert.
Sep 2, 2026 · 2 min
THREATSArgentina
Qilin Tied to Sanatorio Modelo de Caseros
CronUp Ciberseguridad added Sanatorio Modelo de Caseros to a list of Qilin victims, with an attack date of 08-26-2026.
Sep 1, 2026 · 3 min
THREATSUnited States
CHAOS, DragonForce and STORM add ransomware victims
Security Arsenal linked new victims to CHAOS, DragonForce, KRYBIT, STORM and GLOBAL SECRET GROUP, including cases in the U.S.
Aug 31, 2026 · 3 min
THREATSChile
Chile’s Hospital Clínico cited in Direwolf leak
Darkfield, RecentBreaches and Hackmanac added more records on the Hospital Clínico Universidad de Chile case, still unconfirmed.
Aug 31, 2026 · 4 min
THREATSParaguay
Paraguay reports ransomware signs and exposed data
Local coverage says Paraguayan cooperatives are emerging from a ransomware attack, with more than 9 million records exposed online.
Aug 30, 2026 · 2 min
THREATSParaguay
Paraguay Sees More Phishing Complaints
Gaspar said complaints of impersonation, phishing and account theft are rising in Paraguay, with more than 9 million data records exposed.
Aug 30, 2026 · 2 min
THREATS
Latin America sees bank fraud tied to deepfakes
Banks and users in Latin America face impersonation, deepfakes and caller ID spoofing, with fraud attempts and official alerts.
Aug 30, 2026 · 3 min
THREATSMexico
San Luis Potosí City Hall reports extortion after hack
San Luis Potosí City Hall reported 2.9 GB of data theft and an extortion attempt to get it back. The mayor said no deal was made.
Aug 29, 2026 · 3 min
THREATSUnited States
Brazilian domains added to DragonForce, KRYBIT
Frato, neooftalmo.com.br and sysconth.com appear among new DragonForce and KRYBIT victims, with outside checks refining the claims.
Aug 29, 2026 · 3 min
THREATSUnited States
FBI says Medusa tops 500 healthcare victims
A joint FBI, CISA and HHS notice says Medusa has hit more than 500 victims since 2021, with healthcare a frequent target.
Aug 28, 2026 · 3 min
THREATSChile
Chile's Difor claimed by Qilin
Qilin claimed Chilean tech firm Difor. Incident trackers list it as a victim with an estimated attack date of Aug. 23, 2026.
Aug 28, 2026 · 2 min
THREATS
Kazu Targets OSI
Kazu listed OSI and Brazil’s Mobilemed as victims, but public confirmation of the attacks remains limited.
Aug 28, 2026 · 3 min
THREATSUnited States
ATF probes cyber incident in isolated system
ATF said an isolated system was affected and reported no signs of impact to eForms, its corporate network or other systems.
Aug 28, 2026 · 3 min
THREATS
CISA exposes flaws in two U.S. SOCs
AA26-237A details two red team tests against U.S. critical infrastructure and finds gaps in phishing and Active Directory defenses.
Aug 27, 2026 · 3 min
THREATSUnited States
CoinbaseCartel, Storm Target US Victims
CoinbaseCartel, Storm, Qilin, DragonForce and SilentRansomGroup posted new victims in the US and Canada across health, finance
Aug 27, 2026 · 4 min
THREATS
Criba and Flecha Bus Join Ransomware Victims
DragonForce added Criba and Frato, KRYBIT added cases in Brazil and Guatemala, and CoinbaseCartel also posted Flecha Bus.
Aug 27, 2026 · 4 min
THREATSPeru
EsSalud Lambayeque hit by S/1.4M fraud
EsSalud reported five unauthorized transfers totaling S/1,406,991 in Lambayeque and asked banks to freeze the recipient accounts.
Aug 26, 2026 · 2 min
THREATSMexico
ToxicPanda 2.0 Targets 140 Banking Apps
Zimperium found ToxicPanda 2.0, an Android variant expanding to more than 140 banking and crypto apps across 16 countries.
Aug 26, 2026 · 2 min
THREATSUnited States
Ransomware groups add U.S. victims
INCRANSOM, THEGENTLEMEN, METAENCRYPTOR and EVEREST added victims in the U.S. across health, finance, technology
Aug 25, 2026 · 3 min
THREATSUnited States
CISA warns on active Siemens S7 PLCs
CISA expanded its alert on Siemens S7 PLCs and said more than 100 water systems were hit in July, with limited but real impacts.
Aug 24, 2026 · 4 min
THREATSColombia
Colombia steps up grid security in Tolima
Prosecutors asked Tolima authorities, police and the army to report measures to protect the power grid after alleged attacks on transmission assets.
Aug 24, 2026 · 2 min
THREATS
LATAM Pass exposed member data in Brazil
LATAM confirmed a LATAM Pass incident in Brazil that exposed member data. The company said it contained the event and notified Brazil’s ANPD.
Aug 24, 2026 · 2 min
THREATS
Brazil: Arcos in Emperador’s claim
Emperador claims an attack on Arcos city hall in Brazil. The case remains unverified, with no public confirmation from the municipality.
Aug 23, 2026 · 2 min
THREATSArgentina
Argentina's AMCA listed by BLACKWATER
Breachsense flagged amca.org.ar as a BLACKWATER victim on Aug. 17, 2026. Security Arsenal also cited it among two new leak-site victims.
Aug 23, 2026 · 3 min
THREATSUnited States
Medusa tops 500 victims in health sector
FBI, CISA and HHS updated their Medusa alert, saying the group has hit more than 500 victims and kept targeting US health care.
Aug 22, 2026 · 2 min
THREATS
Colombia and Mexico Hit by New Campaigns
Ransomware hit Colombia’s Justice Ministry, while Grandoreiro resurfaced in Mexico, with detections also reported in Peru
Aug 22, 2026 · 2 min
THREATSMexico
Quaker State Mexico listed by Qilin
Quaker State Mexico appeared in a Qilin-attributed listing, with no independent public confirmation of a breach or data theft.
Aug 22, 2026 · 2 min
THREATSColombia
Colombia Faces Ransomware, Justice Ministry Hit
Threat reports place Colombia among recent ransomware victims, while F5 and Security Arsenal also flagged related activity.
Aug 21, 2026 · 3 min
THREATSPeru
Peru logs 83 victims on ransomware.live
ransomware.live lists 83 Peru-linked victims, without attribution to any group. VECERT also reported unconfirmed activity.
Aug 21, 2026 · 2 min
THREATSArgentina
Argentina: The Gentlemen hit critical sectors
Kaspersky attributed attacks on manufacturing, health, tech, finance, construction and logistics to The Gentlemen, with activity confirmed in Argentina.
Aug 21, 2026 · 3 min
THREATSMexico
MECASEM appears in 3AM leak listings
Ransomware.live and Breachsense list mecasem.org as a 3AM victim. GalaxyWarden says there is no public confirmation from the company.
Aug 21, 2026 · 2 min
THREATSUnited States
US ransomware victims pile up in 48 hours
Security Arsenal tracked new U.S. victims from DIREWOLF, COINBASECARTEL and XPL0ITRS across health, tech and professional services.
Aug 19, 2026 · 2 min
THREATSBrazil
Arcos appears in Emperador leak
Brazil’s Arcos city hall appears on a leak site tied to Emperador, but the claim has not been independently verified.
Aug 19, 2026 · 2 min
THREATSArgentina
Argentina Among The Gentlemen’s Victims
Bitdefender’s August 2026 threat debrief placed Argentina among The Gentlemen’s victims as the ransomware group pushed deeper into manufacturing.
Aug 17, 2026 · 3 min
THREATS
Argentina Led Ransomware Victims in July
Bitdefender logged 21 claimed ransomware victims in Argentina in July, with The Gentlemen, Qilin and DragonForce among active groups.
Aug 17, 2026 · 3 min
THREATSUnited States
US Alerts on Gunra, Unlimited Breach Hits 3.8M
US agencies warned on Gunra, while Unlimited Technology Systems raised its breach tally to 3.8 million patients.
Aug 16, 2026 · 3 min
THREATSColombia
Colombia Justice Ministry Confirms Ransomware
Colombia’s Justice Ministry confirmed ransomware hit part of its infrastructure. No data theft was detected, and recovery is ongoing.
Aug 16, 2026 · 3 min