Bolivia Cybersecurity Status, August 2026

Threats and active campaigns in Bolivia

Ransomware and extortion, Consultores de Seguros

The only ransomware or extortion case clearly attributed in August was Consultores de Seguros, linked to Qilin. The material does not allow a determination of whether there was confirmed encryption, exfiltration without encryption, or only a mention on a leak site, so the operational classification remains open.

The strongest signal is the victim’s appearance in trackers and sites in the extortion ecosystem. That includes BreachSense, ransomware.live, HookPhish, RecentBreaches, GalaxyWarden, and HackerFeeds. In all cases, the company’s level of public confirmation does not appear in the material, and the claim still depends on the group’s post or intelligence aggregators.

Fraud and phishing, fake BCB managers

The documented fraud this month centered on impersonating the Central Bank of Bolivia to offer fake loans. The case combined social engineering, QR codes, and instant messaging, with an institutional authority narrative designed to speed up deposits and capture personal data.

There was no second phishing case with the same level of detail in the material. The operational relevance lies in the pattern, because this type of fraud relies on preexisting trust and everyday channels. The BCB responded with a criminal complaint and a public warning, which makes the incident a useful signal for the financial system and for anti-fraud teams.

APT, hacktivism, and disinformation operations, mini bot farm

The Cerimedo case was not presented as a classic APT, but as a structured digital operation that merits monitoring in the disinformation and automation abuse category. Public evidence points to a mini bot farm, seized devices for forensic review, and resources tied to political campaigns on social media.

For Bolivia, this matters because it shifts attention away from technical intrusion and toward manipulation of public conversation. There is no attribution to a state actor or a confirmed intrusion chain, so the incident should be read as hacktivism or organized disinformation only in the broad sense, not as proven cyberespionage.

Critical vulnerabilities with impact in Bolivia

No critical CVEs were reported in the material reviewed for August 2026. Their absence in this table means that no critically exploited or verifiably referenced vulnerabilities appeared in the month’s corpus, not that none exist in the region.

Regulation and compliance in Bolivia

August was more active on regulation than on signs of technical exploitation. The central development was the Senate’s approval of Bill No. 066/2025-2026 on Access to Information, which moved to the Chamber of Deputies. That came alongside progress by the UIF with the FATF, debates on AI and investments, and targeted measures from the SIN on digital security.

Access to Information law and state openness

The Chamber of Senators approved the Access to Information bill and sent the initiative to the Chamber of Deputies. The proposal establishes that information held by the state will be public as a general rule and that anyone may request it without having to justify their reasons.

The debate was not only procedural. Soledad Chapetón explained that the law would cover state institutions, public companies, public universities, and other entities that manage public resources. Civil society organizations and the press pushed the discussion so the process would be simple and accessible, and asked for Articles 8 and 9 to be reviewed because of possible bureaucratic barriers.

Two-factor authentication at the SIN and taxpayer support

The SIN rolled out two-factor authentication for the Virtual Tax Office and for the Linked Third Parties function. The agency said the mechanism follows global cybersecurity standards and is designed to protect taxpayers’ information and assets.

The institutional response included support channels, a toll-free line, and operational recommendations such as checking the registered email account, the spam folder, and inbox availability. ABI reported that only 1% of users experienced difficulties. Beyond that friction point, the month’s message was clear, Bolivia’s tax system moved toward stronger authentication.

UIF, FATF, and financial oversight

The UIF said Bolivia is close to leaving the FATF gray list after making progress in fixing deficiencies related to money laundering and terrorist financing. The material places that progress within reinforced monitoring since June 2025.

That context was tempered by an El Día report citing Fundación Milenio and recalling structural problems tied to organized crime and institutional capture. The contrast is useful, regulatory improvement is real, but it is taking place on still-fragile ground. In parallel, the APS and the BID promoted practices to strengthen financial consumer protection and modernize supervision with a preventive approach.

AI, investment, and the technology agenda

The regulatory ecosystem also moved around artificial intelligence. There were references to AI-related bills in the Chamber of Deputies and to an official investment proposal that places it among priority sectors. This is not yet a comprehensive personal data law or a closed regulatory framework, but rather a work in progress.

A specialized analysis also noted that Bolivia lacks a comprehensive personal data protection law and that privacy is handled mainly through constitutional action. That fits the rest of the month, there is an intention to bring order to the digital space, but there is still no integrated legislative piece that closes the gap.

Most affected sectors in Bolivia

The financial and insurance sector drew the most attention, though not necessarily the most serious technical impact. It included the Consultores de Seguros case, the BCB complaint over fake loans, the debate over digital payments, and regulatory signals from the APS, the UIF and the BID. It is the sector where extortion, fraud, compliance and user trust intersect.

The second major front was the state and tax sphere. The SIN was central, with the rollout of 2FA, support channels and the logic behind protecting access to the Virtual Office. At the same time, the debate over access to information and draft regulations on AI reinforced the idea of a public administration that is more digital and more exposed at the same time.

The third axis was telecommunications and digital infrastructure, with ENTEL, AGETIC and ATT pushing CSIRT Bolivia and Bolivia Cibersegura 2026. That does not imply massive incidents in that sector, but it does signal a structural role. The fourth visible area was the political and media environment, marked by the mini bot farm linked to the Cerimedo case, which opened a debate about automation, manipulation and influence operations.

Trends and signals to watch in Bolivia

Compared with July, August showed fewer verified incidents, fewer unclassified incidents, less ransomware, and less documented fraud or phishing. Regulatory activity also slowed, as did the number of sectors touched by the signal, but the dominant threat remained the same: unclassified. That points to lower volume, not necessarily less complexity.

The drop in documented fraud, from 15 in the previous month to 2 in August, should not be read as evidence the problem is over. In this corpus, there is only one particularly well-documented case, the fake BCB loans, while most of the monthly signal was concentrated in regulation and defensive posture. The deception surface is still active, it just appears less often in the captured material.

The ransomware trend is even more clearly down. The previous month recorded 20 cases with ransomware or extortion as the primary focus, and August had 11. However, this month’s material is heavily concentrated in one strong case, Consultores de Seguros, with the rest spread across trackers and intelligence sources. The lower volume does not erase the value of the case, because it confirms that the insurance sector is also on the pressure list.

The regulatory line deserves close attention because Bolivia is trying to bring several fronts into order at once. If the access to information bill moves forward in the Chamber of Deputies, if the SIN’s 2FA continues to gain adoption, and if the UIF keeps making progress with the FATF, the country could enter a phase of greater procedural maturity. The risk is that regulatory speed does not always translate into equivalent technical capability.

Recommendations for security teams in Bolivia

Review authentication and access policies immediately, especially in taxpayer portals, financial systems, and any service that relies on email as a second factor. The SIN case shows that 2FA is no longer optional in the public agenda, and that it also needs operational support so legitimate users do not see a worse experience.

Strengthen anti-fraud controls on messaging channels and social media. The BCB incident confirms that institutional brand impersonation remains effective when it combines QR codes, time pressure, and loan promises. Mentions, fake accounts, and suspicious payment flows should be monitored with the same priority as a technical alert.

For insurers and financial players, review exposure to reused credentials and exposed access across breach ecosystems. The Consultores de Seguros case shows that a presence on extortion sites can be preceded by credential accumulation or by public visibility of domains and accounts. Identity hygiene and privilege segmentation are the first line of defense.

For public institutions and critical operators, consolidate procedures with CSIRT and clear escalation paths. Bolivia Cibersegura 2026 and the role of AGETIC suggest the country is trying to formalize that layer. If teams do not have tested playbooks, national coordination takes too long once the incident has already become a crisis.

Frequently Asked Questions

What mix of events drove the most visible risk in Bolivia this month?

In August, a ransomware case against Consultores de Seguros, a fake credit scam using QR codes tied to misuse of the BCB brand, and the strengthening of CSIRT Bolivia all unfolded at the same time. Taken together, they point to pressure on finance, user fraud, and institutional response.

Did the Consultores de Seguros case involve encryption, data theft, or only exposure on a leak site?

The available material does not allow that to be determined precisely. The sources confirm attribution to Qilin and the threat to disclose data, but they do not clarify whether there was encryption, exfiltration without encryption, or only a mention on leak sites. The threats section draws that distinction.

What regulatory signals this month affect sectors beyond finance?

Along with progress on the Access to Information Law, SIN strengthened digital authentication, and ENTEL, AGETIC and ATT promoted Bolivia Cibersegura 2026 with a focus on CSIRT. That reaches the state, telecoms and critical infrastructure, not just banks or insurers.

Why does the absence of critical CVEs not mean there is no technical risk?

Because the 0 indicator only reflects that no critical CVEs appeared in the August material analyzed. It does not mean there were no exploited vulnerabilities in the region. The vulnerabilities section and the limitations section explain that distinction so coverage is not confused with operational reality.

Which sectors should prioritize measures over the next month?

Finance and insurance, because of the Qilin case and the BCB fraud, and the public sector as well, because of the rollout of 2FA at SIN and the access to information agenda. Telecoms and digital infrastructure should maintain coordination with CSIRT and response testing.

Material limitations

This report was built exclusively from the material provided for Bolivia, August 2026, and uses only facts dated within that window to calculate indicators. Two facts dated after the period were excluded, and aggregated telemetry was not included because this is not an incident count.

A value of 0 for any indicator, especially the critical CVEs mentioned, means it did not appear in this month’s analyzed material, not that no critical vulnerabilities were exploited in the region. The same applies to categories that could not be recorded with operational precision, such as some ransomware or extortion cases.

Consumer social media posts and sponsored or promotional pieces were also left out as primary evidence, even if some were referenced in the research material. When blog or aggregator content was cited, it was used only to describe what those sources claimed and not as independent confirmation. Facts without a confirmed date were excluded from the counts, although in this corpus it was not necessary to rely on them for the month’s indicators.