Chile Hospital, Oldelval hit by ransomware

Executive summary

The State of Critical Infrastructure 2026 report, cited by Diario Financiero, recorded 1,080 ransomware victims in Latin America between January 2025 and September 2026, with 338 of those cases, or 31.3%, affecting critical infrastructure. The same coverage said critical infrastructure victims in the region rose 28% between January and September 2026 compared with the same period in 2025, from 125 to 160 cases, led in the aggregate by Brazil, Mexico and Argentina.

That aggregate picture, however, should not be confused with a case-by-case list of confirmed incidents. In the material reviewed, facts directly verified by the victim or by an authority are far fewer than claims posted on leak sites or mentioned in threat intelligence reports. That distinction matters because the 338 regional victims include both publicly acknowledged events and cases inferred from press coverage or threat intelligence, without research that can independently audit every entry.

The two best-documented Latin American cases in this set are the Hospital Clínico of the University of Chile and Oleoductos del Valle, Oldelval, in Argentina. At the Chilean hospital, the National Cybersecurity Agency notified the University of Chile about the incident, the institution confirmed a cyberattack that affected the Imaging Service and the RIS PACS platform, and later acknowledged unauthorized access to medical orders and test results. The exposed information included national ID number, full name, sex, age, date of birth, exam date and time, type of exam, referring physician and results. The hospital disabled the compromised account, suspended the external consultation platform as a precaution and filed a criminal complaint.

At Oldelval, BlackFog reported that a cyberattack affected administrative systems at the pipeline operator, but the company activated its cybersecurity protocols, restored the affected systems and kept oil transport running without interruption. BlackFog attributed the incident in an unconfirmed way to The Gentlemen, while noting that Oldelval did not acknowledge the specific threat or attack vector. At the same time, technical analyses of The Gentlemen by Acronis, Cohesity REDLab and SOCRadar describe a ransomware-as-a-service operation with exposed infrastructure, Ghost C2 panels, RevSocks, custom INC builds and double extortion tactics. Those findings help explain the threat, but they do not prove they were used against Oldelval.

The operational reading of this material is twofold. First, the region is still absorbing pressure on critical infrastructure, with visible concentration in transport and logistics, energy, fuels, water and sanitation, health care and government. Second, the gap between extortion claims and confirmed facts remains wide. In health care, the Chilean case shows that unauthorized access to clinical platforms and later publication of sensitive data can be confirmed fairly quickly. In energy and transport, the Oldelval case shows that an incident can hit administrative systems without stopping the core operation. Between those two extremes, most regional records still rely on third-party intelligence rather than publicly verifiable forensic evidence.

Context and background

The starting point for the period is the State of Critical Infrastructure 2026 report from Entel Digital's Cyber Intelligence Center, as summarized by Diario Financiero. The report counted 1,080 ransomware victims in Latin America between January 2025 and September 2026, with 338 critical infrastructure cases. The coverage also said critical infrastructure victims rose from 125 between January and September 2025 to 160 in the same period of 2026. In relative terms, that was a 28% increase, above the global average reported in the note of 26.1%.

The journalistic source also offered a sector breakdown. Transport and logistics accounted for 27.8% of victims, followed by energy, fuels, water and sanitation at 22.2%, and health care and government at 16.7% each. That matters because it maps risk around highly dependent, highly visible services. It is not an economic impact ranking, but a distribution of victims within the sample observed by Entel Digital.

The same report, again according to Diario Financiero, placed Brazil at 80 cumulative attacks, Mexico at 60 and Argentina at 45 during the period reviewed. Chile logged 55 ransomware victims, 18 of them classified as critical infrastructure. In the country breakdown, there were 11 critical infrastructure victims between January and September 2026, compared with seven for all of 2025. That gap suggests acceleration in the second part of the period covered by the report, although the available material does not allow that change to be tied to one ransomware family or one dominant vector.

Outside the aggregate, the documented cases show different behaviors. The Hospital Clínico of the University of Chile ended with a criminal complaint, a data leak of medical records on the internet and visible containment measures. Oldelval, by contrast, reported operational recovery and continued oil transport. In Colombia, BlackFog mentioned an attack on the Ministry of Justice that encrypted files and disrupted public services, but the official investigation found no evidence of information theft and no group publicly claimed it. In Mexico, COMAPA Victoria said it suffered an attempted data hijacking, restored operations from backups and denied exposure of banking or personal data; Yazoul Security said Qilin's claim remained unverified.

That contrast between confirmed records and unverified claims is key to reading the regional picture. Growth in the aggregate figures does not remove the need to distinguish between an intrusion with confirmed access, a post on a leak site and a simple mention in open-source intelligence. Without that separation, the universe of 338 critical infrastructure victims ends up mixing levels of evidence that are not equivalent.

Key facts table

Operation timeline

Attack chain and TTPs

The available evidence makes it possible to reconstruct two distinct layers. The first is that of the confirmed incidents. At the Hospital Clínico of the University of Chile there was unauthorized access to the RIS PACS platform, extraction of medical orders and results, later publication on the internet and containment through the disabling of the compromised account. At Oldelval, by contrast, the confirmed fact is a cyberattack affecting administrative systems, followed by service restoration and continued oil transport. In neither case does the available material let us establish the initial vector, the threat actor or the full intrusion chain with certainty.

The second layer is the technical ecosystem associated with The Gentlemen, which BlackFog linked in an unconfirmed way to the Oldelval case. Acronis describes The Gentlemen as a ransomware-as-a-service operation whose internal infrastructure was exposed in a May 2026 breach. That material made it possible to observe organizational structure, affiliates, infrastructure and ties to the Qilin ecosystem. Cohesity REDLab added that the associated malware showed direct attacks on backups, attempts to delete Volume Shadow Copies, use of vulnerable drivers to disable security products and double extortion with encryption and publication threats.

SOCRadar added the most technical layer. The company described seven adversary-controlled servers, including knowledge and development nodes, a Ghost C2 panel, a RevSocks host and a staging node. It also reported three victim packages prepared for a wave expected on October 1, 2026, 46 custom INC encryptor builds aimed at six victims, and a screenshot showing an encryptor running on a victim machine inside the analyzed infrastructure. Those elements describe an operation in preparation or already under way, but they do not prove it was used against Oldelval or against the confirmed health care cases.

TTPs observed or attributed in the infrastructure analyzed by SOCRadar

From intrusion to extortion noise

The analytical value of separating these layers is high. A leak site can announce a victim, but that does not amount to a confirmed attack, a validated exfiltration or an operational outage. SOCRadar's material shows that The Gentlemen managed infrastructure, ransomware builds and access mechanisms consistent with intrusion and extortion. But what exists against Oldelval in the available material is a journalistic reference to a cyberattack and a possible attribution that remains unconfirmed.

In health care, the chain is clearer. The Hospital Clínico was alerted by the National Cybersecurity Agency, the institution corroborated access to RIS PACS, identified publication on the internet and detailed the types of data exposed. That lets analysts distinguish access, exfiltration or at least data theft, and later disclosure. The part that remains open is the total volume taken and the technical attribution of the actor.

In critical transport and energy infrastructure, the issue is not only encryption. Oldelval kept its core business running, which reduces the visible impact, but it does not erase the incident. The pattern is consistent with campaigns that target administrative, document management or peripheral systems to force payment or create pressure, without necessarily disrupting the central physical operation. That is a plausible hypothesis based on the material about The Gentlemen, but it remains a hypothesis.

Regional impact

Regional overview

The combined regional picture leaves two layers: a broad aggregate and a much smaller confirmed base. Entel Digital, cited by Diario Financiero, recorded 1,080 ransomware victims in Latin America between January 2025 and September 2026, of which 338 were critical infrastructure. At the same time, critical infrastructure victims rose from 125 to 160 between January and September 2025 and 2026, respectively. That places critical sectors at roughly one-third of the regional victims measured by the report.

The sector breakdown concentrated cases in transport and logistics, energy, fuels, water and sanitation, health care and government. That distribution matches the target selection seen in the confirmed incidents. The Hospital Clínico of the University of Chile represents health care, Oldelval represents energy and transport, and COMAPA Victoria represents water and sanitation. The Ministry of Justice of Colombia adds government, although in that case the public evidence points to encryption and disruption, not confirmed theft.

Brazil, Mexico and Argentina accounted for the largest absolute volumes in the aggregate period. Brazil was first with 80 cases, Mexico with 60 and Argentina with 45. But those numbers should not be read as a forensic audit of every incident. The coverage itself warns that there is no individual victim list that would allow each reported total to be verified one by one.

Argentina

Argentina offers two readings that should not be mixed. The first is the Entel Digital aggregate, which puts the country at 45 cumulative cases between January 2025 and September 2026. The second is the Oldelval case, which does have a direct BlackFog report and an unconfirmed attribution to The Gentlemen.

Oldelval, operator of the country's main pipeline network, suffered a cyberattack that affected administrative systems. The company activated its protocols, restored the systems and kept oil transport running without interruption. That matters because it limits the temptation to oversize the event as a physical critical infrastructure outage. The incident existed, but the main operational impact was contained.

The attribution to The Gentlemen appears as an unconfirmed claim from the same intelligence source. BlackFog said Oldelval did not confirm the specific threat or attack vector and that it was still assessing the full scope of the incident. Later, Acronis described The Gentlemen as a RaaS operation with ties to the Qilin ecosystem, while Cohesity REDLab and SOCRadar detailed its technical arsenal and exposed infrastructure. All of that strengthens understanding of the threat, but it does not settle attribution in the Argentine case.

The other Argentine reading comes from Clarín, which cited a CrowdStrike investigation into a campaign carried out between May and August 2026 that compromised at least 15 health care entities. CrowdStrike documented credential theft and clinical histories from at least one organization, but it did not identify victims or speak of interruptions, ransom demands or patient notifications. That case is not linked to Oldelval, but it does suggest intense activity in Argentina's health care sector.

Chile

Chile is the best documented case in the entire set. Diario Financiero reported 55 ransomware victims in the country between January 2025 and September 2026, 18 of them critical infrastructure. It also said there were 11 critical infrastructure victims between January and September 2026, compared with seven for all of 2025. In the sector breakdown, transport and logistics accounted for 27.8%, energy, fuels, water and sanitation for 22.2%, and health care and government for 16.7% each.

The Hospital Clínico of the University of Chile incident offers a concrete view of the health care side of that picture. The National Cybersecurity Agency notified the university about the incident, the hospital confirmed the attack on the Imaging Service and the RIS PACS platform, and the complaint detailed access to exam orders and results. The compromised information included national ID number, full name, sex, age, date of birth, times, type of exam, referring physician and results. That level of detail makes the case an example of clinical data exposure with direct privacy impact and potential for misuse.

The measures taken were also recorded. The hospital disabled the compromised account and suspended the external consultation platform as a precaution while it implemented security improvements. NIVEL4 Labs added that the institution did not initially detect the intrusion itself, but was alerted by the authority, and that the complaint acknowledged that the total scope of the stolen data was still unknown and whether it had been used for other illicit purposes. That leaves part of the file open, but it does not change the core confirmation of unauthorized access and leakage.

ADN Radio added a useful structural detail for interpreting the case. More than 70% of the public sector and 85% of the private sector in Chile use electronic clinical records, according to figures attributed to CENS and ANCI. That does not prove vulnerability by itself, but it does widen the exposure surface when a clinical platform is compromised. The Hospital Clínico episode fits squarely into that kind of dependency.

Brazil

Brazil appears as the country with the most cumulative cases in the Entel Digital report, with 80 attacks. Diario Financiero's coverage did not provide a breakdown by victim, sector, access vector, encryption or exfiltration. For that reason, the number should be read as a monitoring aggregate, not as a basis for local forensic reconstruction.

There is, however, a confirmed operational incident on the health care front through the Federal Police's Operação Insidioso. The investigation was opened for cases tied to system intrusion, data extraction and later extortion, with a search and temporary detention in Joinville, Santa Catarina. The operation was announced on October 7, 2026, and the attack under investigation occurred in July 2026.

CNN Brasil, citing the Federal Police, added that the incident under investigation affected Hospital Einstein in São Paulo and was treated as a ransomware attack. The report said there was unauthorized access to patient data, including names, national IDs or birth dates, prescriptions and exam results. With that information, the Brazilian case does fit a combination of intrusion, access to medical information and formal police response.

Brazilian coverage of ThreatVectr and Ransomware.live adds a methodological caution. Records on extortion pages are criminal claims, not necessarily confirmations by the organizations mentioned. That warning matters to avoid overreading the volume of claims as consolidated evidence of confirmed victims.

Mexico

Mexico appears with 60 cumulative cases in the Entel Digital report and with one of the clearest locally reported incidents, the one involving COMAPA Victoria in Tamaulipas. The utility said it suffered an attempted data hijacking, with files blocked in exchange for a ransom demand. Its general manager later said all data was restored from backups, no ransom was paid and the institution's operation was not affected.

COMAPA Victoria also said its offices and public services kept operating normally once the web tools paused during the response were gradually restored. It also said no personal or banking data from users was exposed, because online transactions and payments are not processed on its servers but on banking platforms and specialized companies. That detail reinforces the idea of operational continuity without confirmed exposure of sensitive data on the utility's side.

The unverified part came from Yazoul Security, which reported a Qilin claim on its leak site but said there were no samples, screenshots, file trees or other proof of compromise. In other words, there was an assertion of exfiltration, but no public validation of that assertion. That pattern matches the methodological warning running through the rest of the report: a leak site does not replace technical evidence or institutional confirmation.

Colombia

Colombia appears in the material with two separate references. One is the attack on the Ministry of Justice reported by BlackFog, which encrypted files and disrupted parts of its technology infrastructure, affecting judicial processes, document management and crop monitoring. Authorities isolated compromised systems and began coordinated recovery. The official investigation found no evidence of information theft and no ransomware group publicly claimed the attack.

The other reference is the unverified ThreeAM claim against Coosalud EPS. Yazoul Security classified it as a claim without public proof of exfiltration, without data samples and without third-party validation. Coosalud had not publicly confirmed or denied the accusation. That is another example of why the regional aggregate cannot be treated as a homogeneous count of confirmed incidents.

Uruguay

Uruguay does not add a confirmable ransomware case in the available material. El Observador reported that Antel attributed its fiber-optic interruptions to physical cuts caused by third parties, not to a cyberattack. For that reason, the event should be excluded from the ransomware universe affecting critical infrastructure.

Countries without additional verifiable facts

Paraguay, Bolivia, Peru and the United States do not add additional verifiable facts in the research available for this investigation.

Technical indicators

SOCRadar's research into The Gentlemen's infrastructure did publish concrete indicators, but they belong to the operation analyzed by that source and should not be mixed with confirmed IOCs from the Oldelval case. The available material does not publish IOCs for the Hospital Clínico or Oldelval incidents as a final forensic package.

Analysis for security teams

The operational priority should not be only to track the aggregate count of victims, but to quickly separate three different states. First, the confirmed-access incident, like the Hospital Clínico case, where there is already evidence of data theft and publication. Second, the disruption or encryption incident without public evidence of exfiltration, like Colombia's Ministry of Justice. Third, the unverified leak-site claim, like COMAPA Victoria or Coosalud, which may signal risk but should not be treated as a settled fact.

For health care teams, the Chilean case leaves three urgent controls. Access traceability in clinical platforms, monitoring of privileged accounts and early detection capability on systems like RIS PACS or equivalents. Notification by the National Cybersecurity Agency was key to discovering the incident, which suggests internal detection can fail if logs, access alerts and anomalous activity monitoring are not correlated.

For critical infrastructure operators in energy, transport and water, the Oldelval case shows that physical continuity can survive a cyberincident if there is rapid restoration and segmentation between administrative systems and core operations. But that same separation should not encourage complacency. A compromised administrative system can become a pressure point, a data leak or a pivot to other surfaces. Backups, isolation and disabling compromised accounts remain the minimum baseline.

The threat layer exposed by SOCRadar on The Gentlemen adds a set of behavioral indicators worth watching in hunting. Ghost C2, RevSocks tunnels, QuickLine or Mythic, abuse of drivers to disable security tools and a preference for financial, legal, HR and executive files. If an organization detects those patterns together with attempts to exfiltrate to cloud storage or the use of valid accounts, the suspicion threshold rises quickly.

At the regional level, the biggest mistake would be to treat Entel Digital's figures as an exact map of confirmed victims. They are not. They are a useful pressure gauge, but their tactical value comes from cross-checking them against authority reports, complaints, institutional response and independent validation. Without that cleanup, a SOC or CSIRT risks prioritizing extortion noise over incidents with real, verifiable impact.