Latin America Ransomware Activity, October 2026

Threats and Active Campaigns

Ransomware and extortion with confirmed encryption

In October, the material points to a relatively narrow set of cases with confirmed encryption. The main one is Program Consultores in Argentina, where the attack disabled municipal servers and systems. There are also other cases with administrative impact, but not always with enough confirmation that encryption was the main mechanism.

Taken together, the picture is that encryption remained present, but did not dominate. Public visibility was split between outages, data leaks, publication threats, and unauthorized access to data. That matters because defenders need to stop treating ransomware as a single event and view it as an intrusion cycle with several possible outcomes.

Exfiltration without encryption and simple extortion

The Einstein Hospital case in Brazil fits this category better, since public confirmation focused on unauthorized access to patient data, with regulatory and police reporting, but without an operational service outage. Cyberint, Cyware, and ATLAS also described N0n as an actor focused on data theft, credential stuffing, exfiltration, and encryption in some cases, which reinforces the range of techniques involved.

This also covers the maritime and logistics campaign linked to N0n, insofar as several sources limited themselves to reproducing leak sites and threats to publish data. When there is no forensic evidence of encryption or confirmation of the affected organization, the correct category is simple extortion or leak site claim, not operational ransomware. That distinction matters because reputational and regulatory harm can be high even without system lockout.

Leak site mention only or unverified attribution

Many of the month’s incidents go no further than a mention on a leak portal or a secondary attribution. ATLAS, Ransomware.live, HookPhish, SecurityArsenal, and other archive sources list organizations in Argentina, Brazil, Bolivia, and other countries, but they do not always provide independent confirmation. In those cases, the value lies in early signal detection, not in treating it as a closed incident.

This is especially visible in the material on Grupo Crónica, Solutend, several N0n lists, and some references to health care or logistics organizations in the region. The end result is a month with a lot of extortion and leak noise, but a smaller share of incidents that clearly show proven encryption or exfiltration.

Fraud and phishing documented

Fraud was not central in volume, but it appeared clearly in Garza. The unauthorized access to an official account and the attempted or completed transfer of 15 million pesos placed the case at the intersection of intrusion, identity abuse, and financial fraud. That kind of incident should not be seen as peripheral, because it is often the first step in campaigns that later escalate into extortion or data theft.

The comparative material also shows that the region remains exposed to phishing campaigns, macros, and abuse of administrative tools as entry vectors. Although those references are not always confirmed Latin American incidents from October, they do illustrate the persistence of a technical pattern that feeds both ransomware and fraud.

APT, hacktivism, and campaigns not strictly tied to ransomware

The October corpus did not include a Latin American campaign clearly classified as APT or hacktivism that would merit the same level of detail as the ransomware incidents. There are mentions of actors with complex operations, automated campaigns, and even AI-assisted environments, but the available material is not enough to turn them into an independent regional axis in this report.

Critical vulnerabilities

The October material analyzed cited 4 critical CVEs. That figure does not mean critical vulnerabilities exploited in the region were absent, only that this month’s corpus did not provide more verifiable references for this report.

Regulation and Compliance

October brought more regulatory and compliance activity than the previous month, although most references centered on incident response and notifications to authorities rather than new rules. The Einstein case is the clearest example, since the institution reported the incident to ANPD and the Federal Police, triggering obligations tied to internal investigation, traceability, and response involving personal data.

In Argentina, regulatory discussion appeared indirectly around the PGM case and local public administration. Exposure of municipalities, along with the possible circulation of data or improper access, raises a compliance layer that is not solved by restoring services alone. In these cases, the relationship with vendors, log retention, and recovery documentation are often as important as technical containment.

The corpus also included references to official bulletins, such as the one from Brazil's CISC, which addressed campaigns targeting government domains and critical vulnerabilities, although the available result does not link those notices to the specific October complaints. That distinction matters because it avoids overattributing a preventive bulletin to a specific incident without sufficient evidence.

For regional organizations, the month leaves a simple signal. When access to personal data or service disruption appears, the regulatory layer is no longer secondary. It becomes part of the incident from day one, for health care and public administration, and to a lesser extent for infrastructure and business services.

Most affected countries in Latin America

Brazil, Argentina, and Mexico accounted for most of the verifiable signal in the month. Peru, Colombia, Chile, Paraguay, and Bolivia appear in the material as context or in third-party mentions, but not with the same density of confirmed incidents during October. The United States appears only in the comparative frame and is not part of this report’s geographic focus.

Argentina

Argentina was the country with the most disruptive incident of the month. The attack on Program Consultores and PGM affected municipalities in several provinces and knocked out services, collections, and administrative platforms. There were also mentions of Grupo Crónica and an organization in Río Grande, as well as ATLAS claims about Argentine victims linked to different groups.

The local issue is reliance on shared vendors. When a single platform supports dozens of municipalities, the incident stops being an isolated case and becomes a systemic disruption. That is why the Argentine hit this month is measured not only by victims, but by functional reach and by the number of localities with degraded services.

Brazil

Brazil combined volume, sector diversity, and direct confirmations. The Einstein case provided the clearest healthcare signal, while ATLAS and other sources listed victims associated with N0n, The Gentlemen, Arcus Media, Eclipse, DireWolf, and other groups. The sectors most affected in the material include healthcare, technology, government, and retail.

Brazil also appears as one of the countries with the highest victim density in the leak repositories consulted. That should not be confused with confirmed incidents, but it does point to sustained exposure across companies, institutions, and the public sector. The practical consequence is that Brazilian teams need to watch not only encryption, but also leaks, regulatory pressure, and activity on leak sites.

Mexico

Mexico remained present in the material, although with fewer fully confirmed October facts inside the corpus. The comparison with previous months still shows the country as one of the hardest hit in the region, and references to campaigns involving perimeter edge devices, VPNs, and supplier chains support that reading.

The key point is methodological. In October, the file offers more context than closed cases for Mexico. That does not reduce the country’s risk, but it does require avoiding an inflated regional count based on material that does not belong to this period or lacks enough direct confirmation.

Colombia

Colombia appears in the material mainly through its historical presence in lists and through third-party references. The file does not present in October a volume of confirmed incidents comparable to Brazil or Argentina, although it keeps the country on the regional extortion and ransomware radar. For operational reading, that means persistent monitoring rather than alarm over a specific spike.

Peru

Peru appears in third-party analysis and in a reference to victims listed by Aur0ra, as well as in comparative material on healthcare and insurers in nearby months. In October, the signal is more indirect than confirmed. Even so, the country remains on the regional exposure map because of its presence in extortion and leak campaigns.

Paraguay

Paraguay appears in the material as part of broader Latin American campaigns and as a jurisdiction affected by ransomware in nearby months. In October, it does not concentrate confirmed facts with the same weight as Argentina or Brazil, but it remains part of the regional dynamic of groups operating against supply chains and service organizations.

Bolivia

Bolivia appears in the Solutend case, although with an unresolved geographic inconsistency in the secondary primary source. That ambiguity prevents using the incident as a firm basis for volume, but it does show how often regional attributions on leak sites are incomplete or contradictory.

Chile and other countries

Chile, as well as other Latin American countries, appears in third-party tracking of campaigns such as SafePay and in references from aggregated coverage, but without equivalent confirmation for October within this file. The absence of a fact in the body of the report does not mean absence of risk, only absence of verifiable material for this month.

Trends and signals to watch

The comparison with September shows fewer verified incidents overall, fewer uncategorized incidents, and fewer ransomware or extortion cases as the primary focus. That drop in absolute volume does not mean less operational pressure. What changes is the shape of the signal, with more concentration in selective cases, leak sites, and attacks against providers or highly exposed institutions.

Ransomware remained the dominant threat, with 73 of 210 incidents, down from 157 of 399 the previous month. That points to a decline in volume, not in relevance. When the main focus stays the same but cases become more dispersed and less uniform, defense needs more correlation capacity and less reliance on isolated indicators.

A second signal is the persistence of data-based extortion. Cases such as Einstein, N0n, and the victim lists on ATLAS show that the line between ransomware, data theft, and publication on leak sites is increasingly blurred. For regional CISOs, that means restoring systems is no longer enough as a complete response if data was also exposed or regulatory pressure followed.

The third signal is sectoral. Health care, local government, maritime transport, logistics, and media continued to appear as highly exposed verticals. That is not new in itself, but October confirms that attackers continue to prioritize organizations with limited tolerance for disruption and immediate public pressure.

Finally, the month confirms that secondary sources are useful for spotting campaigns, but not for inflating figures. There is more leak site noise than confirmation of closed intrusions. Serious analysis requires separating actionable material from simple claims, something that was especially necessary this month in Argentina and Brazil.

Recommendations for security teams

The first adjustment is to stop treating ransomware as a single layer of defense. October showed three distinct and simultaneous paths, encryption, exfiltration, and simple extortion. Teams need to be able to respond to each one with different mechanisms, because restoring from backup does not solve a personal data leak or a publication-based extortion attempt.

The second priority is to review the exposed attack surface of critical vendors. The PGM case shows that a municipal vendor can become a regional amplifier of impact. It is worth mapping which third-party services support sensitive processes, which credentials they manage, how they are segmented, and what happens if they go offline for several hours or several days.

Identity also needs to be hardened as the main defense layer. This month’s material again shows abuse of valid accounts, RDP, misconfigured VPNs, data staging, and legitimate administrative tools. That requires real MFA, privilege controls, anomaly monitoring, credential rotation, and a much stricter policy for remote access and service accounts.

For healthcare, the added priority is to separate availability from confidentiality. The Einstein case shows that an institution can keep operating while suffering improper access to highly sensitive data. That requires playbooks that include early notification, forensic preservation, legal validation, and clear communications with patients and regulators, not just with IT.

In municipalities and local government, the recommendation is to treat shared portals as critical assets. Teams need an inventory of dependencies, tested backups, manual contingency procedures, and a plan for collections, scheduling, transactions, and web publishing when the provider goes down. If there is no manual fallback, the attacker does not need to encrypt everything to cause public harm.

In parallel, it is advisable to monitor leak sites and intelligence repositories with a validation mindset. Not every mention means a real compromise, but a persistent mention can be the first sign of an intrusion that still needs verification. The right flow is to detect, compare, preserve evidence, and only then classify.

October also leaves a cross-cutting recommendation: integrate security, legal, compliance, and crisis communications from the incident design stage. In the region, the costliest cases are not necessarily the loudest ones, but the ones that combine downtime, data exposure, and a poor response sequence.

Frequently Asked Questions

What is the difference between a confirmed encryption case and a simple mention on a leak site?

A confirmed encryption case means assets were taken offline or files were locked, as happened with Program Consultores in Argentina. A mention on a leak site only shows that someone claimed the victim or posted data, but it does not prove an effective intrusion on its own. See the Relevant Incidents and Active Threats and Campaigns sections.

Which countries concentrated the strongest incidents this month, and what kind of impact did they have?

Argentina concentrated the most disruptive incident, with encryption and a shutdown of municipal services, while Brazil produced the clearest health care case, with unauthorized access to patient data. Mexico appears more as a regional exposure benchmark than as a confirmed October volume. See Most Affected Countries in Latin America and Relevant Incidents.

Why does the report separate ransomware, simple extortion, and fraud?

Because the operational and legal impact is not the same. Encryption affects availability, exfiltration compromises confidentiality, and fraud can be financial abuse without technical ransomware. In October, Garza fits fraud, Einstein unauthorized data access, and Program Consultores encryption. See Period Indicators and Active Threats and Campaigns.

Which sectors should prioritize their controls based on this month?

Health care, local government, maritime transport, logistics, and media should tighten controls first, because they were the verticals most present in the verifiable signal this month. The mix of leakage, disruption, and account abuse hits them especially hard. See Regional Overview for the Month and Most Affected Countries in Latin America.

Do the 4 critical CVEs mentioned mean that four vulnerabilities were exploited in the region?

Not necessarily. It means the October material analyzed mentioned four critical CVEs, but it did not always provide full technical detail or a closed link to each Latin American incident. The absence of more CVEs in the report does not mean there were no other critical vulnerabilities in the region. See Critical Vulnerabilities and Material Limitations.

Material limitations

This report was built exclusively from the material provided for October 2026, plus the comparative framework from earlier months included in the file. The facts in the comparative block were not counted as part of the month’s volume, and facts without confirmed dates were excluded from the indicators. When they are mentioned, it is noted that the date is not confirmed.

The indicator window is the one stated in the assignment, 210 dated facts in October 2026, 35 from earlier months used only as comparative reference, and 9 without confirmed dates excluded. The indicators should be read as a signal of the ransomware axis in the region, not as aggregated telemetry or a comprehensive census of all Latin American activity.

A zero indicator, or a field with no detail, does not mean the phenomenon is absent in the region. In particular, if a CVE does not appear or appears without technical precision, that only means it was not recorded in this month’s analyzed material. It does not allow us to conclude that no critical vulnerabilities were exploited in Latin America.

The material also combines primary sources with secondary coverage, third-party analysis, and leak repositories. For that reason, several facts from the period remain partially attributed or uncertain. Promotional sources, sponsored content, and social posts excluded under the instructions were not used as evidence of volume or as the basis for trend analysis.

Finally, sector and geographic comparisons should be read cautiously. A single fact can affect more than one sector, and many mentions of victims on leak sites do not amount to confirmed compromise. In a month with so much extortion activity and so much incomplete classification, separating verified signal from noise is central to the analysis.