Trending:
Mato Grosso Health Department Hit Again in 2026
CiberLATAMbywhalemate
Switch to dark/light mode
Select language
News
Investigations
Reports
RadarLive
Log inSign up for free
Intelligence report

Latin America Cybersecurity Overview, October 2026

More ransomware, fraud, and regulation shaped October in Latin America, with Argentina, Chile, Brazil, and Colombia in focus.

Nov 1, 202635 min read
Latin America Cybersecurity Overview, October 2026whalemateThe platform for managing human risk in cybersecurity.

Key findings

Monthly reference modules

These modules are filled automatically with verified dated facts within the period. Each one states its basis and counting criterion, so the figures reconcile across modules. They are the recurring month-to-month readout; the analysis that follows expands on the cases without repeating this summary.

Indicator window: 851 dated facts in October 2026 · 116 from previous months (comparative frame, not monthly volume) · 33 without confirmed date (excluded from the indicators). Facts from previous months are used only as a comparative frame in the analysis, never as volume for this period.

CIBERLATAM / WHALEMATE Verified Signal Monthly Dashboard October 2026 · Latin America Top threat: Unclassified (339 of 847 events). Coverage: 851 dated events in October 2026 · 116 of … VERIFIED EVENTS 847 period base: total count measured from below based on this total RANSOMWARE / EXTORTION 72 15 encrypted assets confirmed · 5 exfiltration unencrypted (simple extortion) UNCLASSIFIED INCIDENTS 97 breaches or outages without declared threat type FRAUD / PHISHING 128 documented fraud campaigns documented REGULATION 150 rules, resolutions, or sanctions UNIQUE CVEs 14 CVE-2020-3259 / CVE-2023-20269
Verified Signal Monthly Dashboard — Base: 847 verified dated events for Latin America.
MONTHLY FIXED MODULE Threat-axis distribution October 2026 · Latin America Each event is counted in only one axis, so the total is exactly 847. "Unclassified incidents" is the remainder. Unclassified 339 Regulation 150 Fraud 128 Incidents 97 Ransomware 72 Vulnerabilities 61
Threat-axis distribution — Each event is assigned to a single axis based on its classification; the total reconciles to the 847 events in the period.
FIXED MONTHLY MODULE Sectoral Signal Distribution October 2026 · Latin America Base: 847 incidents in the period · total 1046 because 171 incidents are classified in more than one sector. Other / no sector ident… 311 Public sector / CII 266 Finance 141 Telecom 138 Technology 93 Retail / Consumer 37 Healthcare 30 Energy 30
Sectoral Signal Distribution — Heuristic classification by victim sector. One incident may affect more than one sector, so the total may exceed the base.
MONTHLY FIXED MODULE Geographic Distribution of Signal October 2026 · Latin America Each event is assigned to a single country or to regional coverage, so the total is exactly 824 out of 847 events … Argentina 161 Peru 121 Brazil 119 Mexico 116 Regional 99 Colombia 65 Chile 57 Uruguay 53 Paraguay 33
Geographic Distribution of Signal — Verified events from the period grouped by country or regional coverage; each event is counted once.

Monthly executive summary

October 2026 left a regional picture of elevated risk, with 847 verified incidents across Latin America and a heavier mix of intrusion, extortion, fraud, and regulatory change. The month was shaped by two increasingly overlapping vectors: operational attacks on essential services and the malicious use of artificial intelligence for fraud, impersonation, and influence. The clearest signal was that the largest confirmed incident hit health care and municipal governments in Argentina, while Chile, Brazil, Colombia, and Mexico accounted for the period’s most sensitive developments.

The Argentine case involving Program Consultores became the month’s most visible episode because of its operational impact. Coverage confirmed ransomware that knocked systems used by municipalities in several provinces offline and, according to a local source, reached about 250 municipalities. At the same time, CrowdStrike reported a separate campaign, also in Argentina, in which AI agents compromised at least 15 health entities and exfiltrated credentials and medical records from at least one victim. These were distinct incidents, but together they explain why the public sector and health care were among the most exposed areas during the period.

Extortion also kept rising in critical infrastructure, especially in Brazil and Chile. In Brazil, Hospital Albert Einstein confirmed unauthorized access to patient data and notified the ANPD and the Federal Police, while the Insidioso operation advanced in a ransomware case involving the extraction of sensitive data. In Chile, the Huatacondo solar park and its storage system remained offline, keeping the debate over OT resilience alive, and Entel Digital’s analysis again placed transportation, logistics, energy, water, sanitation, and health care among the sectors under the greatest pressure.

The fraud layer was just as intense, although less dominant than in September. Argentina produced several of the clearest cases, including AI-driven investment scams, sexual deepfakes in schools, bank fraud, and organized digital fraud using fake domains. In Colombia, Shadow Parasite showed the industrialization of phishing with 288 fake domains and 47 impersonated brands. In Bolivia, police warned of a rise of up to 300% in digital scams and described voice cloning, fake links, and schemes on WhatsApp and Telegram as common tactics.

Regulation had a smaller role than in the previous month, but it continued to shape the regional agenda. Chile moved ahead with delaying its data protection law, Brazil maintained an active stream of rules, sanctions, guidance, sandboxes, and governance adjustments, and Guatemala again pushed its cybersecurity bill in Congress. The month also delivered a clear sign of institutional maturity, as Brazil’s ANPD sanctioned Feira de Santana for exposure of sensitive medical data and reinforced a supervisory line that no longer stops at warnings.

Regional snapshot for the month

The region came under heavy pressure because verified incidents were not confined to a single type of attack or a single country. There was ransomware with operational impact, extortion built on stolen data, industrial-scale digital fraud, AI-driven influence campaigns, exposure of personal data, and regulatory decisions trying to catch up with a pace of change that had already outrun them. Regional operational risk remains high because several of those lines converge on the same attack surface, health care, local government, financial services, telecom, and energy.

October points to high risk. That is not because of a single spike in volume, but because the material shows a mix of reach, technical variety, and systemic exposure. Ransomware kept moving in through credentials, remote access, and third-party chains. Fraud leaned harder on social engineering and AI-based impersonation. Regulation responded with more enforcement, more obligations, and more oversight of data and digital platforms. The dominant signal was not one malware family, but the normalization of mixed attacks, where a legally relevant incident can begin as a scam, continue as account compromise, and end in extortion or data theft.

Brazil carried the greatest structural weight in the month because of its regulatory density and the presence of cases in health care, energy, the public sector, and finance. ANPD again showed sanctioning power, while the regulatory ecosystem kept adjusting to Open Finance, LGPD, artificial intelligence, and child protection in digital environments. That level of activity does not remove risk, but it does show an institutional market that already treats cybersecurity as a matter of compliance, governance, and operational continuity, not just technical defense.

Argentina drew the most operational attention during the period because of the collision between ransomware, health care, and digital fraud. The combination of municipalities taken offline, compromised hospitals, AI-enabled scams, and deepfake sexual abuse cases shows an environment where the line between cyber incident, economic crime, and reputational harm has become porous. In threat terms, that means the country has to be read not only as a victim market, but also as a testing ground for identity abuse tactics, fraudulent monetization, and extortion pressure.

Chile, Colombia, and Bolivia added different but converging signals. Chile centered the debate on critical infrastructure, energy continuity, and connectivity, along with a regulatory agenda moving toward 2027. Colombia showed a combination of technical exposure, large-scale phishing, and industrialized digital fraud. Bolivia, meanwhile, offered a warning that is useful for the region, fraud no longer depends only on links or SMS, but on cloned voices, emotional manipulation, and the automation of persuasion.

Period indicators

Indicator October 2026 Previous month Change
Verified facts in the period 847 851 -4
Indicator time window 851 facts dated October 2026 · 116 from prior months (comparative frame, not monthly volume) · 33 without confirmed date (excluded from indicators) Same No change
Unclassified incidents (breaches or outages) 97 61 +36
Cases with ransomware or extortion as the primary focus 72 40 +32
Confirmed asset encryption 15 Not provided N/A
Exfiltration without encryption (simple extortion) 5 Not provided N/A
Leak site mention only 1 Not provided N/A
Classification not determinable from the material 51 Not provided N/A
Documented fraud or phishing cases 128 190 -62
Documented regulatory moves 150 322 -172
Critical CVEs mentioned 14 2 +12
Sectors with at least one documented fact 8 8 No change
Dominant threat of the month Unclassified (339 of 847 facts) Regulation (322 of 851 facts) Shift in focus
Facts with direct source confirmation 73% Not provided N/A
Aggregated telemetry figures excluded from volume 4 (aggregated attempts or blocks: these are not incidents with confirmed impact) Not provided N/A

Reading the indicators

The table points to a month that was less regulatory than September, but heavier in operational security and incident response. The drop in regulatory moves does not signal a loosening, but rather a shift in focus, fewer visible initiatives in the coverage and more messy events with incomplete classification. The rise in ransomware and unclassified incidents suggests a more opaque threat market, where news coverage and technical advisories still do not close every attribution gap.

TIMELINE Verified events for the period 1/10 Theownercommissionerof 1/10 According toDiario Panorama,the 1/10 According toTiempo, theCSIRT 1/10 Diario Panoramareported that 1/10 Diario Panoramastated that 1/10 TheCommissionfromScience,
Verified timeline of events, October 2026 — Confirmed milestones within October 2026. Events from earlier months are left out of the timeline and used only as comparison context.

Relevant incidents

Ransomware at Program Consultores and municipal service outages in Argentina

The month’s most visible case was the attack on Program Consultores S.A., operator of the PGM platform, which took down systems used by municipalities across several Argentine provinces. Coverage by Diario Popular confirmed disruptions to procedures, fee collection, and digital services, while La Voz del Interior widened the scope and said about 250 municipalities were affected nationwide. The company said malicious software encrypted files and left servers inoperable, and denied any theft or leak of databases.

The significance of the case goes beyond the technical impact. The incident hit a shared infrastructure layer, which amplifies cascading damage when reliance on centralized software is high. In municipalities, the practical effect is twofold, citizen service slows down and administrative traceability degrades, which becomes especially sensitive when a ransom demand is also in play. Local coverage showed that the debate quickly turned to outsourced technology models and the contractual resilience of vendors.

The reporting trail also left an important nuance on attribution and scope. TiempoSur said more than 250 municipalities and communes across 11 provinces were affected, but noted that the figure came from local coverage and not an independent audit. For a regional reading, the key point is different: ransomware is no longer hitting only large companies or central state entities, but also platforms that support distributed public operations. That forces a review of dependency inventories, continuity contracts, and recovery capacity by client or jurisdiction.

AI-agent campaign against Argentina’s health sector

CrowdStrike said on October 30 that between May and August 2026 it documented a campaign in which a Spanish-speaking operator compromised at least 15 Argentine health entities. The vendor said the attacker used a dual-agent architecture built on Claude Code, with a Supervisor agent choosing the next task and an Executor agent carrying it out. According to the same source, credentials and medical records were exfiltrated from at least one victim.

The piece matters because it does not describe AI as a simple aid for writing phishing lures or automating scripts, but as part of the attack’s decision and execution loop. That shift changes the risk picture for hospitals and clinics, it is no longer just about blocking messages or attachments, but about anticipating more adaptive intrusion chains. IT Brief Asia reinforced that point by noting that the agents made decisions and executed commands during the intrusion, which sets this campaign apart from superficial uses of AI.

The coverage did not publicly identify the compromised entities, and that limits any inference about geographic or institutional exposure. Even so, the fact that the material is tied to Argentina’s health sector and mentions exfiltration of credentials and medical records makes it a reference case for the month. The potential impact is clear, loss of clinical confidentiality, regulatory exposure, and a larger attack surface for follow-on fraud, because credentials and medical data can feed extortion, impersonation, or social engineering.

Hospital Albert Einstein and Brazil’s Federal Police response

Hospital Israelita Albert Einstein confirmed that it suffered a cyberattack with unauthorized access to, and retrieval of, part of its patient database. The institution said the data could include name, CPF, date of birth, medical prescriptions, and test results, and it notified ANPD and the Federal Police. It also said patient care was not affected.

The Federal Police opened Operation Insidioso to investigate a group suspected of ransomware attacks. Metrópoles reported that the investigation began after a notice from an institution that said it had been the victim of an attack with sensitive data extraction in July. Correio Braziliense added that systems and electronic records continued operating normally, pointing to an incident with data impact, but not necessarily broad operational downtime.

That contrast between clinical continuity and information exposure is key to understanding the Brazilian pattern this month. Damage does not always appear as systems being shut down. Sometimes it shows up as data loss, notification obligations, reputational pressure, and possible extortion. The Einstein case also fits the market’s broader shift, data exfiltration before encryption, or without encryption, is now part of the usual monetization chain.

Huatacondo and OT resilience in Chile

The Huatacondo solar park and its battery storage system remained disconnected from the National Electric System, with 0% availability according to the daily report from the National Electric Coordinator on October 27. The same record kept the cause reported on August 27, "cyberattack on the Huatacondo facilities." Diario Financiero added that the Coordinator also linked that alleged cyberattack to the disconnection of transformer TR1 220/23 kV at the Santa Rita substation.

The coverage did not provide technical details or attribution, and that gap calls for caution. But the fact that the disconnection lasted for two months makes the case important as a signal. What matters is not only whether there was a successful attack, but that the infrastructure remained unavailable for an extended period, with effects on public debate over critical energy assets, supervisory control, and remote operations. SolarQuarter and Energía Futura also noted that the attackers’ identity and the reconnection date had not been disclosed.

Chile appears here as a country where industrial cybersecurity is no longer a theoretical debate. An Entel Digital note cited by G5 Noticias placed transport and logistics, energy, fuels, water, and sanitation among the verticals most hit by ransomware in critical infrastructure. The Huatacondo case fits into a broader discussion about OT, power continuity, and cross-dependence with telecommunications.

Shadow Parasite and industrialized digital fraud in Colombia

An investigation attributed to Lumu and published by Impacto TIC identified 288 fake domains used to impersonate 47 brands in Colombia, including financial institutions, digital wallets, payment collectors, and public service companies. Semana added that the operation started with 51 domains and later grew to 288, with 246 IP addresses and 29 autonomous systems, plus seven linked payment gateways. The method included capturing passwords, authentication codes, and card data through fake portals.

The value of the case lies in its scale and operational discipline. This is not an isolated site, but a fraud infrastructure with the ability to rotate domains, divert traffic, and sustain brand impersonation campaigns. That matches what the region has seen for months, fraud has become professionalized and now works like a service, with levels of automation that make it harder to distinguish a one-off campaign from a stable monetization platform.

Shadow Parasite also helps clarify the difference between exposure and compromise. ColCERT issued an alert about 8,699 PHP services accessible from the internet, but said that did not confirm a successful attack. Shadow Parasite, by contrast, describes direct victims of deception. The distinction matters because in Colombia the problem appears to be split between exposed attack surface and impersonation fraud already deployed at scale.

AI scams and digital violence in Argentina

Argentina was the country where fraud, identity, and nontraditional digital harm overlapped most. ESET, through several reports, analyzed an investment scam campaign that combined digital ads, phone-based social engineering, media and public-figure impersonation, and manipulated videos or statements made with artificial intelligence. The coverage even mentioned a supposed platform tied to VT Markets and deepfakes linked to President Javier Milei and a fictitious investment project.

The other side of the same dynamic was more school-based and more serious from a social standpoint. In Lomas de Zamora, students were reported for creating and spreading fake sexual images of classmates, and the courts analyzed phones to reconstruct the creation, circulation, and possible sale of the content. La Nación reported that the case was assigned to a juvenile prosecutor’s office for the alleged crime of manufacturing and distributing sexual images of minors, while Chequeado noted that Argentina still lacks a specific criminal offense for sexual deepfakes.

The combined reading is uncomfortable but clear. AI is already being used both to steal money and to fabricate reputational and sexual harm in school settings. This is not one crime type, but a toolbox that enables financial fraud, extortion, public humiliation, and peer coercion. For security teams, that shifts the discussion from pure technical controls to interdisciplinary response with legal, HR, compliance, and child protection.

OpenAI and covert influence with a regional focus

OpenAI said on October 4 and October 8 that it suspended ChatGPT accounts originating in Russia for using them in covert influence operations aimed at Latin American countries, with a particular focus on Argentina and Bolivia. The company said it detected and blocked two operations that used the tool to draft and update internal reports, and that one of the networks sought to interfere in regional politics. CyberScoop added that false journalist and think tank identities were also involved.

The key point in this case is not just the origin of the accounts, but the regional tailoring of the content. The operation did not stop at generic campaigns. It tried to plant narratives useful in specific political contexts, with references to Argentina and Bolivia. OpenAI also mentioned false content spread in Bolivia at the end of May 2026, which shows a longer timeline than the October reporting window alone.

From a regional cybersecurity perspective, these operations do not replace phishing or ransomware. They complement them. They can erode public trust, amplify rumors, and facilitate fraud, especially when audiences are already exposed to deepfakes, fake accounts, and voice cloning. For October, the signal is that AI not only speeds up attacks, it also speeds up the construction of fake credibility environments.

Active Threats and Campaigns

Ransomware and Extortion

The month showed a clear rise in ransomware and extortion pressure, although full classification remained incomplete in many cases. Of the 72 cases in which ransomware or extortion was the primary focus, only 15 had confirmed asset encryption, 5 involved exfiltration without encryption, 1 was only mentioned on a leak site, and 51 could not be determined from the available material. That breakdown matters because it confirms that the label "ransomware" no longer fully describes the phenomenon.

In Argentina, Program Consultores was the clearest example of encryption with operational impact. In Brazil, Einstein hospital and the Insidioso operation fit more closely with exfiltration, intrusion, and criminal pressure than with a broad service shutdown. On leak sites, the N0n group added another pattern, an extortion campaign centered on data theft and threats of publication, with multiple references in Brazil and other countries in the region, though public confirmation of intrusion was not always available. A Cyberint source even noted that file encryption had not been seen and that the leak portal was relying on stolen data.

The region was also exposed to a shift in preferred targets. Entel Digital analysis cited by G5 Noticias placed transportation and logistics as the most affected sector, followed by energy, fuels, water and sanitation, with health and government also at high levels. That matches what was seen in Brazil, Chile, and Argentina. Extortion is no longer aimed only at money, it is also meant to disrupt infrastructure where the political cost of downtime is high.

Fraud and Phishing

The relative drop in fraud and phishing cases compared with September should not be read as relief. October still saw many impersonation campaigns, but with a more dispersed mix. Argentina added AI-powered investment scams, banking fraud through SIM duplication and the use of a stolen mobile phone to access home banking, along with deepfake sexual abuse cases. Colombia showed the industrialization of brand fraud. Bolivia and Chile issued warnings about vishing, voice cloning, and messaging scams.

Banking fraud alone produced concrete signals. Argentine courts convicted Banco Hipotecario in a case in which a client’s phone chip was duplicated, her home banking account was accessed, and a loan was taken out in her name. In another case, the Santa Rosa Court of Appeals upheld a fine against Banco de La Pampa for failing to adopt adequate mechanisms to verify identity and detect unusual transactions after a phishing attack. These are two different rulings, but both reinforce a trend, responsibility for authentication and detection no longer rests only with the user.

The scale of fraud is also visible in the market layer. In Bolivia, police reported an increase of up to 300% in digital scams. In Colombia, Shadow Parasite showed a broad and organized infrastructure. In Argentina, iProUP reported that Classiscam had used Telegram bots to generate fraudulent pages and that the country accounted for 14.3% of the Latin American activity tracked in that sample. The lesson is that phishing now works not just through volume, but through local specialization and personalized deception.

APT, Cyberespionage, and Influence

APT or cyberespionage activity was not the dominant signal of the month, but it left enough traces to stay in the regional picture. The CL-UNK-1211 campaign, reported by Asobancaria’s Financial CSIRT, showed the use of SysGoRAT, web shells, and reverse shells against Linux servers belonging to government organizations and state-affiliated infrastructure. The alert did not attribute the campaign to a specific state group, but it did confirm remote access, command execution, and information gathering capabilities.

That type of operation differs from ransomware in both intent and persistence. It aims to stay in place, map the environment, and extract information, not to monetize quickly. Although the campaign cannot be elevated to a series of confirmed compromises in October, its regional importance lies in the technical pattern, abuse of exposed servers, persistence chains, and a focus on state or state-adjacent infrastructure. That becomes especially sensitive when paired with the PHP, Nextcloud, NetScaler, or Atlassian exposures seen during the same period.

At the same time, AI-assisted disinformation moved along the line between influence and fraud. OpenAI documented covert operations aimed at Latin America, which puts the need to separate automated propaganda from simple false content back on the table. Operationally, the region is facing a hybrid layer where the goal is not always to steal data or encrypt systems, but to shape perception, erode trust, or prepare the ground for later scams.

Critical vulnerabilities

The 14 critical CVEs mentioned in the material are mostly tied to PHP, Collabora, Atlassian and Citrix, with active exploitation confirmed in several cases. The concentration in infrastructure and collaboration software shows attackers are targeting cross-cutting components, not just niche products.

CVE Software Exploitation Source
CVE-2026-110447 Collabora Online Built-in CODE Server for Nextcloud (richdocumentscode) Actively exploited during September and October 2026, according to MITRE CVE; the official notice calls for updating to 26.4.303 or later MITRE CVE, Collabora Online, CSIRT Bolivia
CVE-2026-109618 PHP Active exploitation confirmed by CISA; affects PHP runtimes and can allow remote code execution CISA, AWS, Unit 42
CVE-2026-109619 PHP Active exploitation confirmed by CISA; affects PHP runtimes and can allow remote code execution CISA, AWS, Unit 42
CVE-2026-21589 Atlassian Data Center and Server, several products Exploitation attempts were observed within two hours of public disclosure Atlassian, The Hacker News, CERT-EU
CVE-2026-107406 Citrix NetScaler ADC and Gateway Critical RCE or DoS risk under certain SAML configurations; Citrix was not aware of unmitigated exploits when it published the advisory Citrix, SecurityWeek, BleepingComputer
CVE-2025-20265 Fortinet Active exploitation mentioned in the official CISC/MJSP bulletin in Brazil gov.br CISC
CVE-2026-42031 CKAN DataStore Listed in the official CISC/MJSP bulletin as a security alert gov.br CISC
CVE-2026-44277 Fortinet FortiAuthenticator Listed in the official CISC/MJSP bulletin as a security alert gov.br CISC
CVE not specified PHP Two critical PHP flaws prompted preventive site shutdowns in Paraguay CERT-PY, local coverage
CVE not specified PHP Disabling the application is not enough, it must be updated or removed Collabora Online
CVE not specified Atlassian Data Center Exploitation observed very soon after disclosure The Hacker News
CVE not specified Cloudflare Containers Not a CVE, but a cross-tenant exposure that the vendor fixed Cloudflare, InfoQ
CVE not specified Fortinet Notice about authentication bypass in Fortinet devices gov.br CISC
CVE not specified SharePoint, CrowdStrike and CKAN Included in Brazilian alert bulletins, with no specific regional link in the material gov.br CISC

The most important takeaway from this section is not the list, but the pattern. The month combined active exploitation, very short disclosure windows and critical dependence on internet-exposed software. That keeps patch hygiene a top-tier issue in Latin America, but with a new twist, many of these flaws affect collaboration, authentication or web publishing platforms that sit at the center of business and government operations.

Regulation and compliance

October’s regulatory story was no less important for being less visible. It was more surgical. Chile pushed back the implementation of Data Protection Law 21.719 to October 15, 2027, with the measure still moving through the legislative process at month end. The debate captured the region’s familiar dilemma, how to demand compliance when the institutions meant to enforce it are still not fully mature.

Brazil stayed in an active, sanction-driven regulatory mode. ANPD closed an administrative enforcement proceeding against the Prefeitura de Feira de Santana for exposing sensitive personal data of 1,241 people in the Diário Oficial, with a warning, publication of the violation, and corrective measures. The case matters because it confirms the authority is no longer focused only on the private sector. It also updated its glossary, published English versions of the LGPD, and kept its AI sandbox moving.

Chile, personal data and the extension

The Chilean Senate approved a bill postponing the effective date of Law 21.719 until October 15, 2027. G5 Noticias, TrendTIC and Diario Financiero agreed on the core point, the proposal moved forward in the Senate and then went to the Chamber of Deputies. The law’s substantive provisions include access, rectification, deletion, objection, portability, blocking, information duties, security, and breach notification.

The political signal is that Chile is prioritizing time to adapt over immediate enforcement. The technical reading is less clear. The delay may give agencies and companies room to prepare, but it also extends the transition period in which the new agency’s sanctioning powers are not fully active. Notes from the University of Chile and Varela Abogados pointed directly to that institutional setup problem. For corporate security teams, that means the regulatory standard is already defined, even if enforcement pressure has been pushed back on the calendar.

Brazil, ANPD and active supervision

Brazil saw several regulatory moves in October. ANPD closed the Feira de Santana case, added new entries to its glossary, released the second part of its artificial intelligence sandbox, and maintained an oversight agenda covering AI systems, biometrics, platform transparency, and child protection. The Senate’s official record also shows pending initiatives linked to personal data and to data protection as a fundamental right.

The Feira de Santana case is the most important because it turns doctrine into concrete punishment. The authority detailed that exposure of sensitive medical data occurred in the municipality’s official gazette, identified six LGPD violations, and ordered corrective measures, including appointing a data protection officer, publishing privacy policies, and preparing an incident response plan. That combination of sanction and remediation should be read as a likely model for similar cases across the region.

Mexico and Guatemala, moving frameworks

In Mexico, the regulatory signal was more focused on payments, minors, and financial oversight. The Secretariat of Security and Citizen Protection issued recommendations to strengthen institutional email security, while the Supreme Court confirmed, according to available coverage, CONDUSEF’s authority to sanction financial entities for regulatory noncompliance. At the same time, the legislative agenda kept pushing rules on the digital economy and the protection of minors in digital environments.

Guatemala revived bill 6347 on cybersecurity and brought it back into congressional debate, with participation expected from the banking sector and the bill’s sponsors. The proposal seeks to strengthen prevention, detection, and response to digital threats. Although the process is still far from complete, the fact that the initiative is back on the agenda shows the region is still trying to institutionalize its response before incident pressure overtakes it again.

Countries Most Affected in Latin America

Argentina

Argentina had the highest concentration of visible incidents in the month, driven by a mix of ransomware, healthcare, financial fraud, AI-enabled scams, and digital violence in schools. The Program Consultores case hit municipalities in several provinces and affected administrative processes and collections. CrowdStrike's campaign increased pressure on healthcare, with at least 15 entities compromised. That came on top of investment scams using AI, sexual deepfake cases, and court convictions for banking fraud and identity theft.

The country stands out as a node where two kinds of risk coexist, operational risk, with impact on local governments and healthcare, and social risk, with deepfakes, digital fraud, and impersonation of public figures or institutions. That mix makes defense harder because it requires coordination across technical security, legal response, and public communication. October's reading is that Argentina's attack surface is not just technological, it is also reputational and educational.

Chile

Chile had a month centered on critical infrastructure resilience, personal data, and digital fraud. The Huatacondo case remained the benchmark for OT continuity. Entel Digital's analysis, cited by G5 Noticias, placed transportation and logistics at the top of critical infrastructure ransomware victims, followed by energy and essential services. On the regulatory front, the country kept pushing to postpone the data protection law to 2027.

The main takeaway for Chile is institutional preparation, but with an operational base shaped by reality. The country is trying to bring order to data handling and enforcement while facing threats against energy and telecommunications. That combination of legislative work and pressure on critical infrastructure places it among the countries with the strongest public debate, but also with significant exposure to highly sensitive incidents.

Brazil

Brazil carried the heaviest weight in regulation, oversight, and personal data cases, along with critical infrastructure that remains under pressure. ANPD's sanction against Feira de Santana, the progress of its AI sandbox, and the publication of glossaries and LGPD versions in English confirm an active institutional framework. At the same time, Hospital Einstein and other cases show that data exposure remains a material problem.

In ransomware, Brazil continues to appear repeatedly in lists, leak sites, and analysis from groups such as N0n, Arcus Media, and other actors tracked by Brandefense and Cyberint. It was also the setting for debates on energy, transportation, and OT, with Guardião Cibernético as evidence of state readiness. The country not only concentrates activity, it also sets the region's strongest regulatory standard for October.

Colombia

Colombia stood out for the structured quality of fraud and the exposed technical surface. Shadow Parasite showed a sophisticated brand impersonation operation. ColCERT warned about thousands of exposed PHP services, and Asobancaria's Financial CSIRT reported SysGoRAT and the CL-UNK-1211 campaign against Linux servers used by government organizations and state-affiliated entities. The country also appears in regional coverage for exposure in telecommunications and energy.

Colombia's October signal is twofold, high exposure and heavy social engineering. There are configuration problems, open services, and compromised credentials, but also increasingly professionalized digital fraud. That makes Colombia especially useful for observing how exposed attack surface, phishing campaigns, and identity abuse blend into a single ecosystem.

Bolivia

Bolivia appeared less for concrete incidents and more for the level of public alert. Police reported an increase of up to 300% in digital scams and described the use of WhatsApp, Telegram, fake banking updates, and voice cloning with artificial intelligence. OpenAI also cited Bolivia as one of the focal points of covert influence operations in the region.

That leaves the country in a delicate position, because the issue is not only the volume of fraud, but also the kind of narrative that can be built with AI. The combination of fraud, political pressure, and automated disinformation calls for response capabilities that cut across security, content verification, and end-user protection.

Peru

Peru was mainly a case of technical exposure and comparative regulatory response. Agencia Andina reported incorrect configurations in servers and cloud services, while other materials from the same comparative period showed an ecosystem with high malware activity and regulatory debate over digital payments and open finance. Although this month did not concentrate high-profile incidents in the main body, the country stood out as a case where the technical surface and financial regulation are still being adjusted.

Mexico

Mexico was more present for regulation, fraud, and attack telemetry than for confirmed incidents during the month. There were alerts about the security of institutional email, debate on the digital economy, payment laws, and child protection obligations on platforms. The material also showed a strong fraud and phishing market supported by AI, although several pieces belong to the comparative framework. October still left a clear signal, the country remains a major pressure point for banking, digital commerce, and financial identity.

Paraguay

Paraguay appeared mainly in critical vulnerabilities and preventive defense. CERT-PY warned about WhatsApp account theft through voicemail access, and the Electoral Justice system temporarily took its websites offline after an alert tied to two critical PHP flaws. The combination matters because it shows a more immediate defensive posture in response to actively exploited vulnerabilities.

United States and relevant international coverage

Although this report focuses on Latin America, some events outside the region help frame the environment. CrowdStrike, OpenAI, CISA, MITRE, Atlassian, Collabora, and Citrix issued alerts and analysis that affect the region through the software used locally. These are not Latin American cases, but they are part of the risk chain that ultimately affects teams in the region when the exposed software is the same.

Last month was dominated by regulation, with 322 documented moves. October fell to 150 and shifted to a mostly "unclassified" axis, with 339 of 847 events. That does not mean less pressure, only less ability to frame it. When a threat remains unclassified, there is usually more noise, more dispersion, and more incidents whose categorization has not yet been closed.

The second trend is the rebound in ransomware and extortion compared with the previous month. Moving from 40 to 72 cases with that primary axis is a material change. Not all of it implies encryption, and in fact the material shows that most could not be determined with precision. Still, it indicates extortion returned to center stage, especially in health care, local governments, energy, and transportation.

The third signal is the drop in documented fraud and phishing, from 190 to 128. That decline should not be read as relief. It appears to reflect a shift toward more complex forms of fraud, less easy to label as classic phishing. The month's evidence points to deepfakes, vishing, voice cloning, fake portals, investment scams, and identity impersonation supported by AI.

The fourth signal is the jump in critical CVEs mentioned, from 2 to 14. This matters because October was a month of exposed infrastructure and urgent patching. PHP, Atlassian, Collabora, and Citrix showed that the window between disclosure and exploitation remains short. For the region, this calls for patching policies that do not depend on monthly windows, but on exposure and service criticality.

The fifth signal is regulatory. Even though the volume fell from September, the month's decisions were more concrete. Chile pushed its data law to 2027, Brazil enacted one, Guatemala advanced, Mexico strengthened guidelines and child protection, and the discussion around AI became increasingly tied to governance, enforcement, and protection of minors. The region is no longer debating only whether to regulate, but how to sustain the capacity to comply.

Security team recommendations

Security teams in Latin America should leave October with three clear priorities. The first is to tighten access controls and reduce exposure of critical services, especially in collaboration software, authentication systems, and web publishing platforms. Vulnerabilities in PHP, Atlassian, Collabora, and Citrix show that a significant share of risk is still entering through common, highly exposed components.

The second priority is to treat AI-driven fraud as part of the security perimeter. That means strengthening identity verification, brand impersonation monitoring, reporting channels, vishing detection, and out-of-band validation procedures. It also means training customer service and operations teams to recognize voice changes, time pressure, and synthetic urgency in the way criminals communicate.

The third priority is incident response planning with extortion in mind, not just encryption. October made it clear that many attacks now move through data exfiltration or threats to publish information before any systems are locked. That requires plans that cover log review, credential rotation, evidence preservation, regulatory communication, and reputational crisis management.

The most exposed sectors should review shared dependencies. Municipal governments, healthcare, energy, transportation, and telecoms need third-party inventories, continuity tests, and recovery exercises. If a supplier’s system goes down, the customer needs to know what is interrupted, how long restoration will take, and who approves recovery. Resilience stops being an abstract concept when a shared platform can take hundreds of organizations offline.

It is also worth increasing scrutiny on regional fraud campaigns. Shadow Parasite, Classiscam, AI-powered investment scams, and sexual deepfakes show that the criminal market knows how to localize its message. Defense, therefore, also has to be localized, through branding, language, the channels used by the victim, support channels, and payment patterns. Generic prevention is no longer enough.

Frequently Asked Questions

What changed between September and October in the regional risk picture?

October shifted from an agenda dominated by regulation to a more fragmented one, with more ransomware, more uncategorized incidents, and a drop in documented classic fraud. This month’s material shows less regulatory order and more operational pressure on healthcare, municipalities, energy, and AI-enabled fraud, according to the Indicators, Incidents, and Trends sections.

Which country had the month’s most visible operational impact, and why?

Argentina accounted for the most visible case because of the ransomware attack on Program Consultores, which disrupted services for municipalities in several provinces, and because of the AI campaign against healthcare that reached at least 15 entities. The combination of those two cases, along with digital fraud and school-related deepfakes, explains its weight in Most Affected Countries and Relevant Incidents.

Does the rise in ransomware mean there was more confirmed encryption?

No. The indicator rises to 72 cases with a primary focus, but only 15 had confirmed encryption, 5 involved exfiltration without encryption, 1 was listed only on a leak site, and 51 could not be classified. That gap between volume and the nature of the impact is explained in Indicators and Active Threats and Campaigns.

Which vulnerabilities should concern a regional team most right now?

The PHP, Atlassian, Collabora, and Citrix vulnerabilities, because they combine high severity, public exposure, and rapid exploitation. This month’s material includes active exploitation in PHP and Collabora, exploitation attempts shortly after Atlassian disclosure, and serious risks in NetScaler. The Critical Vulnerabilities table summarizes the picture.

What is the relationship between AI fraud and traditional cyber incidents?

The relationship is operational, not just conceptual. AI-enabled fraud is already feeding phishing, vishing, identity theft, deepfakes, and investment scams, and it can lead to account access, financial losses, or extortion. October showed that link in Argentina, Colombia, and Bolivia, and expanded on it in Relevant Incidents and Active Threats and Campaigns.

What should a CISO watch in healthcare, energy, or local government during November?

A CISO should watch credentials, shared vendors, exposure of web services, extortion campaigns involving data publication, and identity impersonation using AI. October showed that those sectors are recurring targets and that the damage can be operational, legal, or reputational. The Regional Overview, Most Affected Countries, and Security Team Recommendations sections explain this in detail.

Material limitations

This report was built exclusively from the material provided and the declared time window for October 2026. Facts from the comparative block were used only as a reference for trends and were named with their explicit month when applicable. The 33 undated facts were excluded from the indicators and may be used only as qualitative context if that limitation is made clear.

A zero indicator does not mean the phenomenon was absent in the region, only that there is no record of it in the material analyzed. This applies especially to CVEs and to any category that did not appear with enough evidence in the corpus. Likewise, a decline or rise in any category should not be read as a full regional total, only as a sign of the coverage documented in this period.

Aggregated telemetry figures were not counted as incidents because they describe attempts, blocks, or volume measurements, not confirmed intrusions. They were also not used as proof of higher risk. When mentioned, they were attributed to the vendor and to its time window, in line with the material integrity rules.

This report also excluded social media posts and sponsored or commercial content that are not on the list of permitted sources as a basis for claims. When a story was not supported by a primary source or by a technical or official notice, it was treated cautiously or left out of the main reading. That affects, above all, some secondary references to leaks, fraud campaigns, and technical attribution.

Sources