Mining, Metals, and Natural Resources, Aug 2026

Threats and Active Campaigns

Offensive activity this month centered on ransomware and extortion, with only one reference to fraud or phishing and not enough material to support an APT narrative in the mining and energy space. The impact varied more than the actor’s name.

Ransomware and extortion

Ransomware was the dominant threat of the period, accounting for 26 of 60 verified incidents. Within that set, only 3 cases showed confirmed asset encryption, 6 were limited to a mention on a leak site, and 17 did not allow a precise determination of whether there was encryption, only exfiltration, or a claim with no visible impact. That breakdown matters because it keeps all ransomware from being read as the same phenomenon.

Oldelval fell into the group of cases with contained impact and a public ransomware classification, although the company did not confirm attribution. Ecopetrol, by contrast, is the clearest case of extortion with blocked encryption attempts. Also included is the incident attributed to a French multinational in Chile, reported by BioBioChile as a ransomware campaign with possible exfiltration and payment pressure, although the source does not allow attribution or technical scope to be closed out. In every case, public pressure on the victim was part of the attack.

The month also left a relevant undercurrent for the extractive sector. The Gentlemen, a group described as RaaS in several reports and technical analyses, appeared linked to hydrocarbon victims in Argentina and Colombia. That overlap does not prove a campaign focused exclusively on the vertical, but it does show an affinity for assets where operational continuity, corporate reputation, and regulatory compliance all matter at once.

Exfiltration without encryption deserves separate treatment because it is the attack mode that most closely resembles silent theft. In Ecopetrol, the value of the incident lay as much in the unauthorized download as in the failed encryption attempt. In Oldelval, the public pressure came from a group’s claim, but the company said there was no interruption to transport. In both cases, identity control and rapid system restoration mattered more than malware detection itself.

Fraud and phishing

Only one incident from the month was documented under fraud or phishing. The available source says phishing remains effective in Latin America and that, in manufacturing, a high share of companies reported attacks, but that material is perception telemetry, not an incident from the mining and energy axis. For that reason, it should be read as context, not evidence of a specific campaign against mining or natural resources.

The relevance for the vertical is indirect but real. Natural resource operators depend on email, engineering, maintenance, and contractor chains where phishing still works as an entry point. August did not show an emblematic case of this kind in the axis, but the regional data suggests identity hygiene remains a pressure point for sector companies.

APT and Persistent Intrusion

There was not enough material to sustain an APT campaign identified as such in the vertical during August. What did appear was operational persistence in the form of intrusions with disputed attribution, such as Oldelval and Ecopetrol, and a reference to foreign origin in the Argentine case. That persistence is not the same as a classic APT, but it does point to an environment in which the attacker tries to maintain access, exfiltrate data, or monetize with low friction.

Critical Vulnerabilities

No critical CVEs were recorded in the material analyzed for August 2026. That does not mean there were no critical vulnerabilities exploited in the region, only that none appeared in the sources collected for this report. As a result, the table remains empty, and technical analysis should focus on compromised access, credential abuse, and cloud exposure, not on a list of published flaws.

Regulation and compliance

August brought a clear regulatory shift and a compliance precedent that matters more for how it was handled than for the amount involved. Oldelval reported the incident as a material event to the CNV, and People of Internet underscored that the transparency obligation came from the securities regime, not from any specific cybersecurity rule for critical infrastructure. That distinction matters because it defines who must report and under what framework.

The CNV thus emerges as a disclosure vector, not just a financial regulator. The company said the incident affected administrative systems, crude transport continued without interruption, and the systems were restored. In this case, the public information chain ran through capital markets before reaching a sectoral cybersecurity authority. For other natural resource operators, that sequence sets a governance precedent.

Ecopetrol also showed broader compliance, although of a different kind. The company reported the incident in filings with the SEC, disclosed access revocations, complaints filed with the Fiscalía, and work with specialized firms and national authorities. The regulatory signal is that cloud incidents with account and data impact are no longer handled only as a technical issue, but as legal, market, and corporate governance exposure.

Taken together, the month confirms that cybersecurity compliance in natural resources is shifting toward two fronts. On one side, disclosure to markets and oversight bodies. On the other, access traceability, forensic response, and the ability to demonstrate that critical operations did not stop. Anyone unable to document both will be at a disadvantage with regulators, customers, and insurers.

Countries and most affected subsegments

The countries with the highest density of relevant developments on this axis were Argentina and Colombia, followed by operational signals in Peru, Chile, Brazil and Venezuela. Their weight is not explained by the raw number of comparable incidents, but by the sensitivity of the assets affected and the quality of the evidence available in each country.

Argentina

Argentina was dominated by the Oldelval case, which shaped the country picture in August. Oldelval is the main oil transport network tied to Vaca Muerta, with around 75% of the field's crude flowing through its pipelines, according to business coverage. The incident was reported to the CNV, affected administrative systems and did not interrupt crude transport.

What stood out most in Argentina was not only the attack, but the way it was exposed. The case passed through the securities regulator and was picked up by specialized defense, energy and business outlets. Attribution also remained open between The Gentlemen and other theories, including a single reference to incransom. For a critical infrastructure operator, that level of informational noise is already part of the damage.

Colombia

Colombia was marked by Ecopetrol, a state-owned company whose incident involved corporate cloud, unauthorized download and a blocked encryption attempt. The company confirmed there was no interruption to production, but the exposure of data from thousands of accounts and about 15 related companies makes it one of the month's most relevant events for natural resources in the region.

The country also added the reference to the Ministry of Justice as a ransomware case, which helps frame the broader exposure environment. It is not a mining or energy asset, but it is a reminder that critical operators do not work in isolation. Vendor management, credentials and shared access continue to be a cross-cutting failure point.

Chile

Chile appeared on two different levels. On one side, a journalistic investigation into the French company hit by ransomware and with a subsidiary in Quilicura showed possible exfiltration and extortion pressure. On the other, Bloomberg reported copper supply problems caused by storms and by the shutdown of a mine in Peru, with mention of Chilean mining and logistics operations affected by weather. None of those events amounts to a confirmed Chilean mining cyberincident in the material, but both help illustrate the sector's operational fragility.

Peru

Peru was relevant because of Las Bambas, where MMG resumed operations on August 21 after a shutdown tied to a workplace accident. The report is useful because it narrows the impact on copper supply and avoids a mistaken reading of a cyberincident. There is no evidence in the material of a cyberattack on the mine, only an operational disruption unrelated to cybersecurity.

Brazil

Brazil produced two types of signal. Fortinet telemetry, cited by local media, reported nearly 250 billion cyberattacks between January and July and 69,000 cryptomining occurrences in the country during that period. That figure is telemetry, not a confirmed impact incident, but it shows sustained pressure on Brazil's technology infrastructure.

In addition, a specialized note said cryptomining attempts in Brazil surpassed the full total for the previous year. For the natural resources axis, that matters because illicit cryptocurrency mining competes for computing capacity, power and operational visibility, even if it does not by itself imply an intrusion with confirmed damage to the extractive sector.

Venezuela

Venezuela was shaped by the PDVSA case and the contract with SLB. Reuters and other outlets said the US company gained access to field data to organize and modernize outdated databases after years of neglect and a recent cyberattack. There is no newly documented incident here, but there is a structural consequence of system deterioration and the need to regain control over critical information.

Trends and signals to watch

The month’s main trend is the jump in ransomware and uncategorized incidents compared with July. The comparative report shows 26 cases with ransomware or extortion as the primary focus, up from 7 the previous month, and 26 uncategorized incidents, up from 8. That shift cannot be explained by more media noise alone. It points to a threat that is more visible, easier to monetize, and harder to classify accurately.

The second signal is the drop in documented phishing and the limited presence of fraud. Moving from 4 to 1 fraud or phishing case does not mean the vector disappeared, only that it lost prominence in this month’s material to extortion campaigns. For defensive security, that suggests operational attention should focus less on isolated email threats and more on persistent access, identities, and lateral movement.

The third signal is the growing role of regulatory disclosure as part of the incident. Oldelval showed that the relevant filing before the CNV can be the mechanism that shapes the public narrative. Ecopetrol did something similar with the SEC, the Fiscalía, and corporate communications. That means teams need to prepare not only technical containment, but also an evidence chain suitable for regulators and auditors.

The fourth signal is the rising importance of cloud. Ecopetrol was not hit through an exposed PLC or an isolated terminal, but through cloud storage environments and user accounts tied to several companies in the group. In mining, metallurgy, and natural resources, where risk narratives usually center on operational technology, August was a reminder that the corporate layer remains the most profitable target for attackers.

The fifth signal is that the absence of critical CVEs in the material does not improve the outlook. If the month was organized around credentials, access, exfiltration, and RaaS, defenders should read that as an identity, segmentation, and data visibility problem. No standout vulnerability explained everything. What did appear was enough offensive maturity to exploit what already exists inside networks.

Recommendations for security teams

For mining, metals, and natural resources security teams, the priority should be to strengthen identity controls and recovery capabilities, because August saw intrusions that advanced without the need for a publicly identified critical vulnerability. The most significant incidents relied on access, cloud environments, exfiltration, and extortion pressure.

First, review the privileges of administrative and third-party accounts. The month left enough signs of permission abuse and compromised access to treat excessive privileges as an operational risk, not an issue of basic hygiene. Any contractor with unnecessary access to production, cloud, or support systems should be placed in immediate recertification.

Second, harden segmentation between administrative and operational environments. Oldelval showed that an attack can remain confined to administrative systems, but that does not make the problem less serious. Strict separation between transport, industrial control, ERP, and identity services remains one of the few barriers that can stop a corporate intrusion from becoming operational.

Third, test access revocation and exfiltration response. Ecopetrol stood out for its ability to block encryption and revoke compromised credentials. Those actions cannot be improvised in the middle of an incident. They should be rehearsed through drills that include cloud services, document repositories, service accounts, and third-party access.

Fourth, prepare a regulatory disclosure package before an event occurs. The Oldelval case shows that the wording of the report to the regulator, the timeline, and the technical evidence matter as much as containment. Legal, compliance, and security teams should agree on thresholds, templates, and communication owners before an incident happens.

Fifth, monitor leak sites and attribution channels with judgment. The month saw groups claiming attacks and contradictory versions about who was responsible. That makes it necessary to separate useful intelligence from attacker propaganda. Public attribution should only factor into operational decisions when there is independent corroboration, not when the group claims it.

Frequently Asked Questions

What do August’s Oldelval and Ecopetrol cases have in common that other incidents this month do not?

Both incidents combine critical infrastructure, public exposure and regulatory response, but with different impacts. Oldelval reported disruption to administrative systems without stopping crude transport, and Ecopetrol confirmed unauthorized access and encryption blocking. The comparison is developed in Relevant Incidents and Regulation and Compliance.

Why does the report insist on separating encryption, exfiltration and a leak site?

Because August showed three different impacts under the same ransomware label. There was confirmed encryption in a few cases, a single public mention on a leak site in others, and several situations where the material did not allow the typology to be closed. That distinction appears in Active Threats and Campaigns and in the Period Indicators.

What changes for a natural resources operator if there were no critical CVEs in the material?

The defensive focus changes. This month, the risk did not come from a published flaw but from access, credentials, cloud environments and extortion pressure. That means identity, segmentation and recovery should take priority over hunting for a specific vulnerability. The nuance appears in Critical Vulnerabilities and in Trends and Signals to Watch.

Which country was most exposed by the combination of cybersecurity and regulatory disclosure?

Argentina, because of the Oldelval case. The incident reached the CNV, was reported as material information and was tied to the continuity of oil transport. Colombia also had a major case with Ecopetrol, but there the focus was more on exfiltration and encryption blocking than on capital markets disclosure. See Countries and Subsegments Most Affected.

Does cryptomining telemetry in Brazil count as a sector incident?

No. These are automated attempts or blocks, not intrusions with confirmed impact, and therefore they are not counted in the month’s volume. They do, however, serve as contextual signals for pressure on technology infrastructure and resource consumption. The methodological clarification appears in Period Indicators and Material Limitations.

Material limitations

This report was built exclusively from the facts provided for August 2026 on mining, metallurgy, and natural resources in Latin America. The indicator window includes 64 dated facts from August 2026, 7 facts from earlier months used only as a comparative frame, and 1 undated fact that was excluded from the indicators.

A zero value in an indicator, especially the critical CVE count, means none were recorded in the material analyzed, not that they were absent in the region. The same logic applies to other categories that were not observed or appeared in low volume. An absence in the corpus does not equal a real absence of the phenomenon.

Aggregated telemetry figures, such as attempts, blocks, scans, and weekly vendor averages, were excluded from the incident total. If they are mentioned, it is only as context and with the clarification that they are automated attempts or blocks, not confirmed-impact intrusions. Consumer social media and sponsored or commercial content that was not enabled as a primary source for external claims were also excluded.

The available material gives priority to news sources, technical reports, and corporate or regulatory notices. That makes it possible to reconstruct the Oldelval and Ecopetrol cases with considerable clarity, but it leaves less certainty about attribution, exfiltration volumes, and fine-grained classification in several incidents. Where the source did not allow a fact to be closed out, the report says so explicitly rather than overinterpreting it.