Situación Nacional de Ciberseguridad - Junio 2026 - Chile

Critical vulnerabilities with impact in Chile

The table condenses the set of risks with the highest operational impact for Chile during the month. Not all of them belong to the same attack family, but they converge on the same control points, browsing, workstations, Windows domains, exposed servers and mobile platforms in corporate use.

For Chrome, the risk is direct because the exploit is triggered by simply visiting a malicious page. That makes the end-user surface a critical front. In Windows, the problem is more structural, since Netlogon and BitLocker affect services with high privileges or direct value for data protection. The combination of both fronts requires priorities to be set by exposure, not by the order in which the bulletin arrived.

Regulation and compliance in Chile

June was a month of regulatory implementation for Chile. ANCI opened a public consultation to define mandatory baseline cybersecurity standards for organizations subject to the Framework Cybersecurity Law, based on Exempt Resolution No. 140 and with comments due by June 29, 2026. That window shows the regulatory framework is still being adjusted, but it is already having concrete effects on what each organization will have to demonstrate to the authority.

In parallel, one of the first milestones of Law 21.663 took effect in June, requiring Critical Infrastructure Operators to show ANCI that they meet new digital security requirements. ADN Radio noted that the penalty regime can reach 40,000 UTM, a figure it estimated at more than 2,800 million Chilean pesos. The practical meaning is immediate: maturity is no longer measured only by controls in place, but by evidence of compliance and documented response capability.

The same logic extends to the Council for Transparency, which published its 2026 Manual of Transparency, Integrity, and Access to Public Information for Authorities. Although the document is not part of the core of operational cybersecurity, it does affect the handling of public information and the documentation discipline of government bodies. For teams working in government, municipalities, public companies, or regulated institutions, the line between security and transparency is increasingly narrow.

SERNAC also appears, which during CyberDay 2026 carried out a special digital inspection, monitoring advertising, consumer information, costs, and shipping times, while also warning about digital fraud and deceptive practices. This places online fraud in a space where security, consumer protection, and compliance converge. The impact is no longer only technical, because reputational and regulatory damage can stem from a poorly executed purchase or a phishing campaign tied to major commercial events.

Added to that is Law No. 21.719 on Personal Data Protection, which several Chilean media outlets reported in June as fully in force from December 1, 2026, with administrative fines of up to 20,000 UTM for serious violations and the creation of a Data Protection Agency with oversight, investigative, and sanctioning powers. The month made clear that the second half of the year would not be read as a waiting period, but as the final stretch to prepare inventories, contracts, legal bases, incident notices, and response processes.

Financial sector and digital fraud in Chile

This month’s material does support a discussion of the financial sector and digital fraud with enough evidence. First, because ANCI identified 34 banking-sector operators within the OIV roster, placing banking under a regime with explicit expectations for notification, continuity, and proof of control. Second, because public debate this month was packed with references to fraud via phone calls, WhatsApp, SMS, and e-commerce channels.

G5 Noticias’ report on 3,123 attacks per week in Chile did more than cite a headline figure. It places the country in a high-exposure category, which for banks and financial services means more pressure on authentication, transaction monitoring, identity protection, and fraud response. The line between a technical attack and financial fraud gets thin when the most valuable asset is not the server, but the credential or the session.

June also brought several news pieces on vishing and digital fraud. Mundo en Línea reported that Chile closed 2025 with a historic record of 41,703 fraud cases before the Judiciary, although that figure is attributed to the source and cannot be treated here as consolidated. The same publication said vishing would account for 71% of phishing-type fraud, according to a joint study by the University of Chile and SERNAC. TrendTIC, for its part, said nearly 1 in 3 digital fraud cases in Chile is linked to vishing and that the average amount stolen would reach $1.3 million. Both pieces point to the same phenomenon, social engineering remains the dominant vector for end-user fraud.

Publimetro added another layer, reporting that 60.1% of Chileans would have been victims of some kind of financial fraud through digital platforms and that between 122,000 and 135,000 phishing emails are detected each month. Those figures were published as recent, but the available excerpt does not provide methodology, so they should be read as journalistic references, not official statistics.

At the same time, HackingChile described the most common impersonations in local phishing as targeting BancoEstado, Banco de Chile, Falabella, Ripley, Correos de Chile, and the SII, while also noting the widespread use of smishing. That overlap across brands, logistics, and tax administration helps explain why digital fraud in Chile tends to be opportunistic and mass-market, not necessarily sophisticated, but persistent.

CyberDay week added more noise. Radio Cooperativa posted a Facebook alert about an increase in QR code fraud involving home-delivery parcels during the event. There is no need for a complex technical chain when the attacker exploits user urgency, the expectation of a purchase, and a brief interaction with a malicious QR code. In banking and payments, effective response depends on transaction controls, anti-fraud education, and verification filters, not on a single layer.

Regional overview: Chile in the LATAM context

Chile emerges in June as one of the Latin American countries where cybersecurity regulation is starting to turn into measurable operational obligations, not just policy debate. The OIV roster, the three-hour reporting deadline, the public consultation on standards and the explicit reference to steep penalties place the country at a more advanced stage of institutionalization than is usually seen in broad regional assessments.

The technical noise, moreover, was global, not local. Microsoft, Google, Adobe and Android accounted for the bulk of patching activity, while CISA, NVD and several international response teams classified multiple vulnerabilities as actively exploited. Chile sits within that same exposure cycle because its technology stack depends heavily on international software and because its critical sectors, from energy to healthcare, run on IT supply chains that do not recognize borders.

June, then, pointed to a clear picture: the country is not facing an isolated threat, but the combined pressure of three fronts, regulatory compliance, urgent remediation and large-scale user fraud. The region shares the same campaigns and the same affected products, but Chile enters that conversation with greater regulatory density and with a universe of critical operators already named by the authority.

Period indicators

Reading for security teams in Chile

The first priority is still operational, not theoretical: inventory, classification, and response times. If an organization falls under OIV, June makes clear that the regulatory clock is already running. Three hours to report incidents leaves no room for improvisation, so the crisis room, legal workflow, and technical classification capability should be practiced before an event, not after.

The second priority is patch management with exposure in mind. The Chrome and Netlogon cases show that having the patch is not enough. Organizations need to verify deployment, force restarts in Chromium browsers, review versions on managed endpoints, secure domain controllers, and confirm that mitigations are actually active. In environments with many remote assets, visibility into compliance matters as much as downloading the package.

Third, June confirms that attackers are still looking for the pieces that open the network, not necessarily the final asset. A browser with an exploitable flaw, an unremediated Windows domain, or a session stolen through vishing can have equivalent effects if they enable persistence and lateral access. Defensive focus should be on reducing entry opportunities, hardening identity and monitoring, and quickly closing escalation paths.

Fourth, the digital fraud front should be treated as part of the security program, not as a customer service add-on. The data on phishing, QR codes, vishing, and brand impersonation shows that an organization that does not coordinate anti-fraud efforts, communications, and identity protection ends up reacting too late. In regulated sectors, that lag can also lead to reputational exposure and compliance costs.

Fifth, the second half of the year demands documented readiness. The public consultation on standards, the progress of Law 21.719, and the actual implementation of the controls in Law 21.663 create an environment in which declaring controls is no longer enough. Evidence, traceability, updated policies, third-party contracts, continuity exercises, and criteria for classifying incidents are all needed before December.

Material limitations

This report was built exclusively from the material provided. No verifiable observations were accumulated during the period, and the month’s internal statistics are listed as zero. For that reason, several assertions rely on deep research confirmed by source, while other newsroom details, though useful for context, appear in the material as source-attributed and are not used as consolidated facts.

No unverified figures were added, and no trends were extrapolated beyond what the available sources allow. Nor were victims, campaigns, or impacts assigned if they were not explicitly documented in the corpus provided. In particular, the ransomware case associated with Chile could not be reconstructed as a single campaign during June, although there is evidence of activity recorded on specialized platforms.

The period showed a clear imbalance between regulation, global vulnerabilities, and digital fraud. That makes it possible to describe the pressure on Chilean organizations with precision, but not to assert, based on the available material, a direct correlation between a specific incident and a particular sector beyond the cases and categories mentioned.