Energy, Electricity, and Utilities (Critical

Threats and Active Campaigns

The month showed three threat families with very different profiles, but tied by the same trait, the pursuit of economic and operational impact on essential infrastructure. Extortion returned with force, phishing became more industrialized, and OT-focused actors continued exploiting software and configurations with international exposure.

Ransomware and Extortion

October saw 9 cases with ransomware or extortion as the primary focus, up from 1 the previous month. Of those 9, the material clearly identifies only one case of exfiltration without encryption, while in 8 the classification could not be determined from the available information. That distinction matters because a mention on a leak site, a data leak, and encryption that disrupts assets have different consequences for business continuity and legal response.

The Petrosul case in Brazil illustrates the gray area. Securelyn Intel and DeXpose recorded a DragonForce claim against the company, classified as part of the fuel sector, and reported a threat to publish data. However, the sources do not verify intrusion, data access, or operational impact. Strictly speaking, the source does not allow a conclusion that encryption occurred, so the event should remain in the category of an attributed but unconfirmed claim in terms of impact.

Even more revealing was the aggregated Entel Digital picture cited by Diario Financiero. It reported that between January 2025 and September 2026, Latin America recorded 1,080 ransomware victims, 338 of them critical infrastructure organizations. For the 2026 subset, the region saw a 28% increase compared with the same period in 2025, from 125 to 160 cases. The figure is not specific to October, but it helps explain why the month included more coverage of extortion targeting essential sectors.

Fraud and Phishing

Digital fraud had a clear profile in Colombia and was closely tied to public services. Coverage of the Empresa de Acueducto y Alcantarillado de Bogotá explained Search Engine Phishing as a method that uses search results or ads to direct users to fraudulent sites that imitate official pages. Another report said the entity had received more than 8,200 reports during 2026 about fraudulent links for paying bills found in search engines.

The Shadow Parasite campaign reinforces the same pattern. The goal is not necessarily to break into a system, but to catch the user at the moment of payment or inquiry. That matters for utilities because the commercial relationship with the customer is part of the business and part of the attack surface. If the user cannot spot the fake URL, the impact shifts to support, account recovery, refunds, and loss of trust.

There was also volume telemetry, not incidents, and it should be placed in context. Infobip said it blocked 56% more malicious messages in Latin America than the year before, and that phishing accounted for half of those regional blocks. That describes attempts and automated blocking, not confirmed intrusions. The data helps frame pressure on messaging channels, but it should not be counted as an operational event for the month.

APT, Hacktivism, and OT

The material did not show solid attribution to APT or hacktivist actors in the vertical, but it did include technical exposure signals that matter to OT operators. CISA advisories on Hitachi Energy and Siemens highlighted vulnerabilities in products used in the energy sector, with risks of command execution, file reading, authentication bypass, privilege escalation, and denial of service. In parallel, the Huatacondo case showed how an outage can last for weeks when recovery is not resolved quickly.

October’s takeaway is that OT risk does not depend only on the appearance of a sophisticated actor. It is also fueled by exposed software, end-of-life firmware, and products with global presence in critical environments. The attack surface is there, and the month’s material confirms it with several advisories at once. The challenge for the region is not only to detect an advanced actor, but to manage the inventory, lifecycle, and exposure of industrial platforms that still sustain real operations.

Critical vulnerabilities

The month brought 11 critical CVEs cited in verifiable material, a sharp increase from the previous period. That does not mean all were exploited in the region, or that all correspond to observed incidents. It does show that the vertical's OT ecosystem was exposed to a broader set of known weaknesses, several tied to vendors present in energy and utilities.

The vulnerability pattern matters as much as the list. Hitachi Energy appears in two separate advisories, one on Asset Suite and another on TRO600, which reinforces the need to review inventory, versions, and exposure of operations and support components. Siemens, meanwhile, concentrates a broad set of flaws in RUGGEDCOM CROSSBOW and another advisory on the Station Access Controller. That means the risk is not limited to a single product, but extends across entire families used in energy and transportation environments.

Regulation and compliance

The regulatory side was not as busy as the technical one, but it did leave two useful signals for compliance and governance. One came from Peru, and the other from the Latin American sector debate over regulatory recognition and tariff treatment for electric-sector cybersecurity.

In Peru, the National Digital Security Center published Integrated Digital Security Alert No. 213-2026-CNSD, with a report and technical analysis of attacks on public entities and private companies during October 30. The available material does not describe a new sanction regime for energy in detail, but it does confirm official analysis and response activity. In parallel, a study published by pv magazine Latinoamérica, based on information from ADELAT and 25 utilities in ten countries, said that Peru has partial technical provisions and incident reporting obligations, but no comprehensive electric cybersecurity framework.

That contrast matters. Having alerting capacity is not the same as having a strong sector framework. The material suggests that the region still combines scattered obligations, partial frameworks, and different levels of maturity across countries. It also shows that electric cybersecurity is already part of concrete regulatory discussions, not just incident response. That pushes legal, compliance, and technology teams to work together, especially where notification requirements or public consultations apply.

Countries and most affected subsegments

The most visible countries this month were Chile, Brazil, and Colombia. Not because they were the only ones with documented incidents, but because they produced the densest, most concrete, or most sensitive material for this vertical. Peru also showed relevant signals, along with comparative references that help place the region as a whole.

Chile

Chile concentrated the period’s highest operational severity. Huatacondo remained offline two months after the cyberattack attributed by the National Electric Coordinator, and coverage also linked it to lost supervision, remote control, and disconnection of supporting assets. That was reinforced by Entel Digital’s report on ransomware victims in Chilean critical infrastructure during 2026, which placed energy, fuels, water, and sanitation as a significant share of the essential services universe.

The most exposed subsegment was renewable generation with storage. That does not mean it is the only vulnerable one, but it does mean the month’s most visible case belongs to that ecosystem. What defines the risk for Chile is the persistence of the incident rather than its initial entry point: two months out of service, official records, and no public reconnection date in the material reviewed.

Brazil

Brazil stood out on two different fronts. On one, Conab reported cyberattacks on systems and digital services. On the other, the country hosted the Guardião Cibernético exercise, with scenarios focused on critical infrastructure in energy, water, transport, and communications. In addition, the record attributed by unconfirmed sources to Petrosul, a fuel-sector company, shows that Brazil’s ecosystem is also on the radar of extortion groups.

The energy subsegment that emerges here is fuels and associated logistics, rather than the electrical grid itself. The mix of attack, simulation, and possible ransomware claim gives local teams a useful snapshot: digital assets are under pressure, but there is also institutional training capacity that should translate into faster response and better coordination between public and private actors.

Colombia

Colombia was the most visible country for digital fraud. Shadow Parasite, fake payment portals, and search and impersonation campaigns put public services at the center of the scam. The damage here is not an OT outage or service interruption. It is the erosion of the user relationship channel, the burden on support teams, and exposure of personal and financial data.

The affected subsegment is public utilities billing and administrative services. October’s signal is that utility fraud now operates like an industry, with domains, IPs, impersonated brands, and associated payment gateways. For Colombia, that means a monitoring agenda built around brand protection, domain takedowns, and coordination with end users, in addition to technical protection of internal systems.

Peru

Peru did not produce a high-impact incident comparable to Chile’s, but it did generate a set of compliance and institutional response signals. The CNSD alert confirms analytical activity around attacks on public and private entities, while the ADELAT study cited in the material points to structural gaps in the electricity cybersecurity framework, with limited oversight and insufficient protection in many cases.

In subsegments, the message is more about governance than operational crisis. The discussion over tariff recognition and sector obligations shows that electricity cybersecurity is moving into more specific regulatory territory. That matters because when the rule does not recognize the cost or the mandate, investment tends to remain fragmented and dependent on isolated initiatives.

Trends and signals to watch

October’s main pattern is a split between lower aggregate volume and higher technical intensity. The month recorded 55 verified events, down from 66 the month before, but risk did not fall by the same margin. On the contrary, ransomware or extortion gained ground as the primary focus, critical CVEs mentioned increased, and two clear narratives took hold, one involving prolonged operational impact and the other more industrialized digital fraud.

The comparison with the previous month also offers a useful signal on classification. In September, uncategorized items dominated, with 33 of 66 events. In October, incidents became the leading category, with 19 of 55 events. That points to clearer reporting and, perhaps, coverage closer to verifiable impact. It should not be read as an improvement in security, but as an improvement in the traceability of the events that came to the surface.

Another signal to watch is the growing pressure on OT products. Hitachi Energy and Siemens appeared repeatedly in CISA advisories and vendor notices. When that happens, the risk does not end with the individual vulnerability. It is amplified by installed inventory, dependence on older versions and the difficulty of patching within limited operating windows. In utilities, every week of delay can carry operational costs.

It is also worth tracking fraud targeting public services, because it is more likely to grow before visible ransomware does. Impersonation campaigns do not need to compromise a PLC or disrupt a substation. They only need to copy an interface, buy traffic, place themselves in search results and wait for clicks. It is a high-yield, low-cost threat that wears down companies and users.

Security team recommendations

The first priority is to review exposure across OT assets and the products cited in October advisories. If an organization uses Hitachi Energy or Siemens in operations, filing away the alert is not enough. Teams need to verify versions, dependencies, compensating controls, and remote exposure. The goal is not only to patch, but to know which assets are affected, which can be isolated, and which require temporary mitigation.

The second priority is to strengthen operational continuity around prolonged outages. The Huatacondo case shows that an incident can keep affecting operations for weeks if there is no clear reconnection traceability, telecontrol validation, and coordinated recovery with the grid operator. Teams should have specific procedures for loss of supervision, loss of telecontrol, and safe return to service.

The third priority is to close the gap between technical security and the customer channel. In utilities, search fraud and portal impersonation are not a peripheral issue. They require monitoring of lookalike domains, communications campaigns, validation of official links, and reporting or takedown mechanisms. If the user reaches the fake site first, the damage has already started.

The fourth priority is to refine internal incident classification. October showed that extortion, leakage, and mention on a leak site are not equivalent. A team that groups everything under ransomware loses response and reporting capability. It is better to separate confirmed encryption, exfiltration without encryption, and mere attributed mention, because each triggers different business, legal, and operational decisions.

The fifth priority is to integrate compliance and cybersecurity. Where there are public consultations, integrated alerts, or partial frameworks, as in Peru, the technical team should engage early with legal and regulatory affairs. Regulation does not resolve the incident, but it can impose deadlines, evidence requirements, and responsibilities that shape the response.

Frequently Asked Questions

What explains October having fewer total incidents but higher technical risk pressure?

October closed with 55 verified incidents, fewer than September, but the density of technical signals increased: 9 cases with ransomware or extortion as the primary focus and 11 critical CVEs mentioned. Risk was concentrated across fewer fronts, but with greater severity and closer proximity to operational continuity.

Which case left the most serious operational signal for the vertical?

The most serious was Huatacondo in Chile, because the solar park and its BESS remained out of service with zero availability throughout October. Coverage also cited the forced disconnection of the TR1 transformer at Santa Rita and the loss of supervision and remote control, which broadens the impact beyond a single asset.

How should the jump in ransomware from the previous month be interpreted?

It should be read as a rise in visibility and relevance, not as a mechanical sum of all extortion types. The indicator rose from 1 to 9 cases, but the material distinguishes between exfiltration without encryption, undetermined classification, and only an attributed claim. That distinction changes the operational and legal reading.

Which countries contributed the most useful signal for energy and utilities teams?

Chile provided the clearest operational impact, Brazil combined a digital incident and a preparedness exercise, and Colombia concentrated fraud and phishing against public services. Peru added regulatory and compliance context. Together they show that the vertical’s risk is not uniform and that each country pushes a different angle.

How should the CVEs mentioned in October be handled?

They should be treated as a priority exposure list, not as an abstract total. CISA and Siemens advisories point to Hitachi Energy and Siemens RUGGEDCOM, products tied to energy environments. The immediate step is to inventory versions, review exposure, and define mitigations if patching cannot be done right away.

Do phishing block telemetry figures count as an incident for the month?

No. The Infobip figure describes automated attempts or blocks, not confirmed intrusions. It helps contextualize pressure on digital channels, but it should not be added to the incident count or used as evidence of operational impact in energy or utilities.

Material limitations

This report was built exclusively from the material provided for October 2026 and from two events from previous months used only as an explicit point of comparison, not as part of the period’s volume. There was also one event without a confirmed date, which was excluded from the indicators. The geographic and sectoral scope is Latin America, with a focus on energy, electricity, and critical infrastructure utilities.

An indicator shown as zero or without a breakdown, especially CVEs or ransomware classification, means it was not recorded in the material reviewed, not that it does not exist in the region. The same applies to the lack of confirmation of actor, vector, or leak in several incidents. The absence of data does not mean the absence of an event.

The declared time window for the indicators includes 56 dated events in October 2026, 2 events from previous months as a comparative frame, and 1 undated event excluded from the count. The indicators in this report are based only on events dated within the period and on their verifiable classification.

Aggregate telemetry figures, such as attempts or automated phishing blocks, were excluded from the volume because they are not incidents with confirmed impact. Sources not allowed under the editorial rules were also excluded, and social media or posts not included in the list of available sources for citation were not used.