Logistics, Ports, Airports and Transport, Aug. 2026

Active Threats and Campaigns

Ransomware and extortion with uneven impact

The set of ransomware and extortion cases was broad, but operational quality varied widely. Only one case showed confirmed asset encryption, ICN. Two other incidents aligned with exfiltration without encryption, Uber Freight and LATAM Pass, where the material describes unauthorized access and improper data leakage or consultation. Three cases were only mentioned on a leak site, Oldelval, Integraduanas and Flecha Bus, without official confirmation of the full impact. Nine cases did not allow the mechanism to be determined precisely from the available evidence.

That distinction matters because it changes the defense posture. When encryption is confirmed, the priority is recovery, segmentation, backups and forensic preservation. When exfiltration dominates, the focus shifts to notification, fraud, customer protection and identity controls. When a case appears only on a leak site, the team should treat it as a risk signal, not as a closed incident. The month showed all three forms coexisting in the same sector.

Oldelval was the clearest example of a mention with continuity preserved. Integraduanas and Flecha Bus were left as third-party claims without official confirmation in the material reviewed. Metaencryptor and The Gentlemen also appear as recurring names across different sources, suggesting a RaaS ecosystem or opportunistic extortion rather than a single, uniform campaign. Analytical caution is required, because not every name on a leak site means the same level of impact.

Fraud and phishing

The month produced a single documented fraud or phishing incident, but its potential impact is high because of the type of data exposed. The LATAM Pass case points to a very clear fraud risk, even if it was not described as a phishing campaign in the strict sense. The combination of names, email addresses, phone numbers, addresses, membership number and miles balance is useful material for impersonation and targeted social engineering against customers likely to respond.

In transportation and airlines, the line between breach and fraud is crossed quickly. Loyalty data can be used to reset passwords, simulate travel notifications, request false validations or attempt fraudulent point redemptions. For that reason, customer notification and coordination with the ANPD are part of damage control. At the regional level, the key point is not that there was only one fraud case, but that the documented material shows a database large enough for that fraud to grow later.

APT and hacktivism

This month's material did not show a consolidated regional APT campaign against logistics, ports, airports or transportation in Latin America. There was a reference to Lazarus linked to exploitation of a Windows zero-day in campaigns against defense and aerospace in several countries, including Brazil, through fake job offers. That event did not turn into a direct incident in the vertical covered by this report, but it does signal targeting of environments close to sensitive infrastructure.

The only case that comes close to an activist or demonstration-style action is the one in Córdoba, where a researcher carried out tests and disclosed critical flaws, but the material frames it as ethical hacking and a report to CERT.ar, not as a hostile intrusion. It is important to distinguish that from a hacktivist campaign. For the month analyzed, there is not enough evidence to describe an APT or hacktivist operation against the vertical based on verified facts in the region.

Critical Vulnerabilities

The material reviewed mentioned a single critical CVE, CVE-2026-68820, tied to a Lazarus campaign against the defense and aerospace sectors in several countries, including Brazil. No other critical CVEs were recorded in this month’s evidence. That does not mean critical vulnerabilities were absent from exploitation in the region, only that they did not appear in the corpus reviewed for this report.

This should not be read as a structural improvement in exposure. It instead suggests that August was shaped more by materialized incidents than by the disclosure of new critical flaws. In a month where the focus shifted to breaches, ransomware, and regulatory responses, CVE visibility declined. The technical risk remains, but it was not the main documented signal in this period.

Regulation and Compliance

Regulation took center stage in August because several cases forced disclosure, escalation, or contract reviews. Oldelval had to report the incident to the CNV under the material event regime, and People of Internet pointed out that this was the legal framework that made the disclosure public. In practice, that means transparency came from a market disclosure obligation, not from any specific critical cybersecurity rule.

LATAM followed a different but still regulatory path. The company reported the incident to Brazil’s ANPD and notified customers who may have been affected. That response separates an internal operational problem from an exposure that triggers personal data oversight. For airlines and loyalty programs, coordination among security, privacy, and customer service is no longer optional.

In Córdoba, the municipal government announced an internal audit of the company that provides the transportation system, along with a review of technology contracts. That matters for public agencies and mobility operators because the incident does not end at the technical layer. When third parties have access to sensitive data and remote control, contractual and oversight measures matter as much as patching vulnerabilities.

The regulatory takeaway for the month is that Latin America still relies on fragmented frameworks to force incident disclosure. Capital markets, data protection, and administrative audits emerged as the channels for transparency. In the material reviewed, there was no equivalent sign of regional sector coordination for ports, airports, or land transportation.

Countries and most affected subsegments

Argentina

Argentina accounted for a substantial share of the signal because of the combination of Oldelval, Córdoba, the airports, and mentions of Flecha Bus and Integraduanas. The pattern was not uniform. In oil and energy logistics, Oldelval maintained physical continuity. In urban transportation, Córdoba showed much deeper technical exposure, with access to databases, credentials, and potential control of equipment. At airports, the damage was concentrated in customer data and parking and reservation services.

The country-level reading is that Argentina showed both critical infrastructure and vulnerable satellite services. It also showed the difference between learning about an incident through the press, as the Córdoba municipal government said, and managing one through formal channels. The most exposed subsegment was not a single vertical, but the technology integration layer between mobility, customer service, and operations.

Brazil

Brazil was the other main focus of the month, with LATAM Pass, ICN, and the reference to Lazarus. The airline case was linked to personal data and compliance with the ANPD. ICN, by contrast, was a ransomware incident with confirmed encryption of IT systems and possible data preservation through backups. Together, the two cases point to a country facing simultaneous exposure in air transport, shipbuilding, and corporate data environments.

What stands out in Brazil is the coexistence of privacy breaches and operational ransomware. The issue is not only data theft, but also how repositories, backups, and notification channels are protected. The fact that ICN was able to preserve data thanks to backup copies is useful, but it should not obscure the fact that files were encrypted in a sensitive environment.

Mexico

Mexico appears with lower volume, but with signs of extortion against Integraduanas, a logistics, supply chain, and warehousing company focused on foreign trade. The available material did not confirm the incident through an official source, but it does include a public claim by Qilin and a warning about a possible data leak. For a foreign trade operator, that kind of mention is enough to trigger monitoring of credentials, document exchange, and customer exposure.

Most exposed subsegments

The most affected subsegments were urban transportation, airports, third-party logistics, ports, and transport energy. Each showed a different kind of damage. Córdoba showed potential control over mobile assets. Argentine airports and LATAM Pass showed exposure of personal data. Oldelval and North Carolina Ports showed degraded but uninterrupted continuity. Uber Freight, along with the claims involving Flecha Bus and Integraduanas, suggests that outsourced logistics remains a highly attractive target for extortion and data theft.

Trends and signals to watch

The comparison with the previous month is clear. August rose from 23 to 67 verified incidents, with a sharp jump in unclassified incidents, from 3 to 27, and in regulatory actions, from 0 to 10. The shift in the dominant threat, from vulnerabilities to incidents, shows that the month’s corpus was much more concentrated on events that had already materialized than on theoretical exposure. That requires regional teams to prioritize detection, containment, and reporting, not just patch management.

The second change is diversification. The previous month had only three sectors with at least one documented incident, while August reached seven. That expansion matters because it reduces the chance of assuming the problem affects only one subindustry. When airports, ports, urban transport, oil, airlines, and digital logistics all appear together, the right reading is systemic.

The third signal is that the month produced more administrative incidents than total operational outages. That can be read as a relative positive, but it would be misleading. Intrusions into IT, accounts, portals, reservations, and email are enough to create fraud, delays, and recovery costs. Physical continuity does not equal full resilience.

The final signal is regulatory. Without formal moves, many incidents would have remained invisible or limited to tech press coverage. The fact that 10 events led to communication, audit, or notification shows that pressure for transparency is rising. For regional security, that means preparing the incident exit as carefully as the technical response.

Security team recommendations

First, business and operational domains need to be separated more rigorously. This month showed several times that damage enters through satellite systems, not the physical core. Airports, ports, and urban transport should immediately review segmentation across reservations, parking, loyalty, email, TOS, OCR, card top-ups, and control systems. If a vendor manages those environments, the contract must require telemetry, notification timelines, and recovery tests.

Second, exfiltration should be treated as a first-tier threat, even without encryption. LATAM Pass and Uber Freight show that data access can be as damaging as ransomware. That means strengthening DLP, monitoring unusual access, alerting on large downloads, controlling administrative accounts, and reviewing email and cloud repositories. In loyalty programs and document logistics, stolen data can fuel later fraud.

Third, restore backups in practice, not just on paper. ICN preserved data thanks to backup systems, but that outcome cannot be assumed. Teams should rehearse restores from immutable backups, validate recovery times, and confirm whether the backup is isolated from the same compromised identity. In ports and transport, real RTOs are often longer than the plan promises.

Fourth, expand monitoring of third parties and the integration ecosystem. The Córdoba system exposed administrative accounts, cameras, top-ups, documents, and remote functions. That means a poorly segmented vendor can open a large attack surface. Reviews should include an inventory of integrations, MFA for admins, credential rotation, centralized logs, and a least-privilege policy that extends to subcontractors.

Fifth, prepare public notification and response templates before an incident. Oldelval, LATAM, and the municipality of Córdoba ended up responding under pressure from the press, CNV, ANPD, or CERT. It is better to have prewritten texts, workflows, and assigned owners. In logistics and transport, delayed information often amplifies reputational damage more than the initial intrusion.

Sixth, strengthen detection of abuse across portals and peripheral services. The Argentine airports were exposed in parking and reservations, not in flight control. That kind of surface deserves session review, credential review, adaptive captchas, database segregation, and integrity controls. When personal data is the target, the attacker does not always touch the most visible system.

Frequently Asked Questions

What changed since July in the transportation and logistics axis?

August showed a sharp jump from July, with more verified cases, more unclassified incidents, more affected sectors, and 10 documented regulatory moves. Last month, the dominant theme was vulnerabilities. In August, real incidents, breaches, and formal response took center stage, especially in Argentina and Brazil.

Which case had the clearest confirmed operational impact?

The case with the clearest impact on continuity was North Carolina Ports, used here as an operational comparison because it forced manual operations. In Latin America, Oldelval kept crude transport running without interruption, while ICN had confirmed encryption in IT. Operational severity depended more on the type of system affected than on the name of the actor.

Which incidents exposed travelers' or customers' personal data?

LATAM Pass and the attack on three Argentine airports accounted for the main exposure of personal data. In LATAM, names, birth dates, emails, phone numbers, addresses, and loyalty program data appeared. At the airports, emails, phone numbers, license plates, and postal codes tied to a parking and reservations service were compromised.

Was there ransomware with confirmed encryption in the regional vertical?

Yes, the only case with confirmed encryption in the material was ICN, in Brazil. Oldelval had claims and a mention on a leak site, but the company said the incident was confined to administrative systems and did not interrupt transport. For the rest of the extortion cases, the available evidence did not allow the mechanism to be determined precisely.

What should sector security teams prioritize?

They should prioritize segmentation between operations and satellite services, protection of personal data, tested backup restoration, third-party monitoring, and regulatory notification readiness. This month’s cases show that harm enters through email, loyalty programs, parking, reservations, document logistics, and administrative systems, rather than through the main physical operation.

Material limitations

This report was built exclusively from the facts provided for August 2026, plus three facts from earlier months used only as a comparative frame and always with their month stated explicitly. No internet or any other source outside the allowed material list was used. Aggregated telemetry was also not included, because the material did not provide it.

A zero indicator, especially for critical CVEs, means none were recorded in the material analyzed, not that no critical vulnerabilities existed in the region. The same applies to any missing category. The time window for the indicators is the one declared at the start of the document, 67 facts dated in August 2026 and 3 from earlier months used only as a comparative frame, not as monthly volume.

Consumer social media and sponsored content or press releases were excluded as evidence, and no source outside the available source list was cited. Facts without a confirmed date were not used because they are not part of the indicators. When the material did not allow a distinction between encryption, exfiltration, or a mere mention on a leak site, that ambiguity was kept in the text rather than assigning a label that was not supported by the source material.

Technical appendix: indicators of compromise and TTPs

No verifiable IoCs were published in the material allowed for this report. Nor were hashes, domains, IPs, or TTP lists documented with enough detail and a citable source within the analyzed corpus. For that reason, this section is omitted without adding speculative content.

Frequently Asked Questions

What is the difference between an administrative incident and a full operational outage?

An administrative incident affects email, data, portals, or support repositories, while a full operational outage disrupts the main physical function. Oldelval and LATAM showed administrative or data impacts, and North Carolina Ports served as a reference for degraded operations without necessarily implying a total shutdown of the main service.

How much weight did regulation have in August?

It was one of the clearest features of the month. Oldelval disclosed its incident under a capital markets obligation in Argentina, LATAM reported it to Brazil's ANPD, and the municipality of Córdoba opened an internal audit. Regulation did not stop the incident, but it did push transparency and public traceability.

Which subsegments of the vertical were most exposed?

The most exposed were urban transport, airports, outsourced logistics, ports, and transport energy. Córdoba showed potential control over mobile assets, Argentine airports and LATAM Pass exposed personal data, and Oldelval and ICN combined critical continuity with IT disruption. The most sensitive surface was satellite systems and administration.

Why does the material say the month was high risk?

Because there were 67 verified events, 27 incidents without a defined category, 15 ransomware or extortion cases as the primary focus, 10 regulatory moves, and 7 sectors with at least one documented event. The impact also reached airports, urban transport, pipelines, logistics, and ports, with effects affecting both data and operations.

Countries and most affected subsectors

Chile and airlines

The only incident tied to a company with broad regional reach was LATAM Pass, which affected LATAM Airlines Group and exposed member data from the loyalty program. From an industry perspective, the most exposed subsector was airline loyalty, because it combines identity, travel history, and economic value accumulated in points or miles.

Urban transport and mobility

Córdoba showed that urban mobility can be exposed by poorly segmented technology integrations. The system reviewed by Ignacio Navarro included buses, taxis, cameras, reloads, and identity documents. That means urban transport has to be seen as a complex technology platform, not just a fleet of vehicles.

Ports and cargo logistics

Ports and cargo logistics were represented by North Carolina Ports, Uber Freight, and complaints involving Integraduanas and Flecha Bus. The common pattern is the value of email, shipping documents, the TOS, and gate processes. Disruption does not need to reach cranes to affect timing, coordination, and costs.

Security team recommendations

About customer data and loyalty programs

Separate loyalty, identity, and payments databases, review access to balances and points, and enable alerts for changes to email, phone number, or password recovery. When a breach exposes names, birth dates, and program details, the risk of follow-on fraud rises quickly. The response must include clear communication to users.

About ports and terminals

Isolate TOS, OCR, EDI, gate systems, and third-party access, and test manual operations without relying on the same identity environment. The North Carolina Ports incidents show that manual continuity can be maintained, but with delays. In Latin American ports, that delay may be the first visible sign of a larger compromise.

About reporting and governance

Define in advance who notifies the CNV, ANPD, CERT, or sector authorities, and which thresholds trigger each channel. August made it clear that transparency can come through different channels. If the organization expects to improvise that part during the incident, reputational damage will widen.

Graphics