Qilin Claims and Interseguro Breach in October 2026

Attack chain and TTPs

The material does not allow a single attack chain to be reconstructed, because it actually combines different incidents with very different evidence levels. What can be said is that the dominant regional pattern during the period was the publication of claims on extortion sites, followed in some cases by partial victim confirmation or by reporting on operational impact. At the strongest end of the spectrum, Colombia’s Ministry of Justice suffered encryption and technological disruption. At the weakest end, many references to Qilin, Direwolf, Panzer, SafePay, Nightspire, or DragonForce only establish the existence of a public claim.

The available intelligence suggests several recurring techniques, although not always explicitly. There are references to unauthorized system access, extraction of sensitive data, publication on leak sites, and threats to disclose information if contact or negotiation was not established. In Interseguro’s case, the company itself spoke of unauthorized access and blocking of compromised access points. In Brazil, the Federal Police described a case involving sensitive data extraction and later payment demands. In Colombia, BlackFog did mention file encryption. Beyond that, the material provides no IOCs, hashes, C2 infrastructure, initial access vectors, or detailed TTPs.

Regional impact

The region shows a mix of real operational pressure, unverified criminal claims, and publication campaigns on extortion sites. The most repeated pattern is not visible encryption, but the posting of victim names on leak portals and the indexing of those entries by intelligence trackers. Only in a few cases does a direct victim confirmation or a clear description of functional impact appear. That forces a country-by-country separation between what is confirmed and what is only claimed.

Regional overview

Overall, the material shows heavy use of leak sites as a public pressure mechanism. Qilin accounts for several mentions, but not all of them correspond to verified incidents. Direwolf, DragonForce, Emperador, Panzer, SafePay, and Nightspire fill out the claim map across different countries, while the clearest confirmation of a serious technical incident remains the one affecting Colombia’s Ministry of Justice.

Argentina

Oldelval suffered a cyberattack that affected its administrative systems and forced it to activate cybersecurity and restoration protocols, but oil transport continued without interruption. The reference source attributed the incident to The Gentlemen, while making clear that the victim did not confirm that threat or the attack vector. For now, the case sits between real impact and unverified attribution.

Chile

Chile concentrates several leak site claims with different levels of consistency, but no public confirmation from the victims. Cotesma appears linked to Qilin in intelligence records, with a tracking file placing it as a Chilean organization allegedly affected. LD Constructora was also published by Qilin, according to third-party reporting. In parallel, Anwo S.A. appears in a SafePay claim with an alleged threat to publish data. None of those cases comes with independent evidence of encryption or exfiltration.

Bolivia

Solutend was listed by Panzer with a supposed 35 GB exfiltration, but the sources reviewed make clear that this is information indexed from the leak site and not forensically verified. Breach House, Recent Breaches, and SecurityIncident.net all treat the case as an unconfirmed claim. For now, there is no public notification from the company or independent confirmation of the authenticity of the alleged data.

Peru

Peru combines one victim-confirmed case with several uncorroborated claims. Interseguro notified clients of unauthorized access, limited the scope to its own systems, and said its policies and operations continued to function. It also said the potentially involved information mainly covered identification data, contact details, and policy numbers. In the same country, TQC S.A., Hermilio Valdizán Hospital, Segres Systec, and the claim against the Government of Peru and Gob.pe remain in the realm of intelligence or public claims without independent validation.

Colombia

Colombia is the country with the most technically solid incident in the period. The Ministry of Justice was hit by ransomware that encrypted files and disrupted its technology infrastructure. The official investigation found no evidence of information theft, and no group publicly claimed responsibility. That makes the case a useful comparison point, because the impact was real even if criminal attribution remains unresolved.

Brazil

Brazil brings together a formal police operation and two additional signals of interest. The Federal Police announced Operação Insidioso, based on a prior attack involving extraction of sensitive data and payment demands. Albert Einstein, meanwhile, reported access to patient data but said it found no evidence of disclosure or misuse and that clinical systems kept operating. Later, Brame Telecom appeared linked to Qilin in intelligence records, again without independent confirmation.

Mexico

MCM Telecom appears in a series of records associated with Qilin. Darkfield and Ransomware.live reproduce the group’s claim, but there are not enough details to confirm encryption, affected systems, or exfiltration. There is also no company statement confirming the incident. For now, the case is a leak site mention, not an established event.

Uruguay

The Association of Notaries of Uruguay was claimed by Nightspire on October 8. DeXpose, Kalir Brief, Ransomware.live, FalconFeeds, BreachSense, PrivTools, and Rosetta Intel all recorded the inclusion, but none of those sources provides independent verification of intrusion, encryption, or exfiltration. The case neatly illustrates the information overload generated by leak portals before any public confirmation from the victim exists.

United States

Vicksburg, Mississippi, reported a ransomware incident that temporarily took down municipal systems, although essential services remained operational and recovery was carried out in stages. In parallel, October activity trackers show the United States as the country with a large volume of claimed victims, but those figures combine operator claims, not verified incidents. The difference between observed volume and confirmed volume remains decisive.

Paraguay

No additional verifiable facts were identified for Paraguay in the material provided.

Technical indicators

No verifiable IOCs were published in the research material. The cited sources describe victims, claims, discovery dates, and in some cases alleged data volumes, but they do not provide hashes, malicious domains, IP infrastructure, exfiltration paths, or artifacts that would allow a reliable indicator list to be built.

Analysis for security teams

The operational priority is not to chase every criminal claim, but to separate confirmed exposure from leak site noise. Teams should treat incidents with victim confirmation or proven operational impact as higher urgency cases, such as Interseguro, Colombia’s Ministry of Justice, Oldelval, and Vicksburg. Those cases provide a real basis for checking containment, credential changes, segmentation, and business continuity.

In Interseguro’s case, the sequence suggests a pattern of unauthorized access that was contained in time, with access blocking, key rotation, and continuous monitoring. That calls for a review of privileged accounts, remote access, authentication traceability, administrative activity logs, and possible lateral movement paths. It is also wise to isolate any third-party dependencies that rely on those systems. The value of a case like this is not the figure claimed by the actor, but the containment discipline applied by the victim.

For Colombia’s Ministry of Justice, the reading is different. The issue was not only initial access, but encryption and disruption of sensitive public services. Here the focus should be on coordinated recovery, service restoration, integrity validation, and review of the scope of impact. The absence of public attribution does not reduce the need to monitor persistence, reinfection, and incomplete recovery states.

Unconfirmed claims, such as MCM Telecom, Cotesma, LD Constructora, Brame Telecom, Solutend, TQC S.A., or the Association of Notaries of Uruguay, require a different approach. They should not be ignored, because they may foreshadow real exposure, but neither should the published data be assumed to be complete or authentic. In those cases, the useful work is internal intelligence, checking for correlates such as anomalous access, account changes, credential leaks, unusual traffic, or signs of exfiltration that can move the case from claim to evidence.

The deeper lesson for security is that leak sites act as pressure amplifiers. They publish names, alleged volumes, and disclosure threats, but the real analytical value depends on whether the affected organization confirmed the incident, whether functional impact exists, and whether there is technical proof of compromise. Separating those layers avoids both underreporting and unnecessary alarm.

Frequently asked questions

Which cases in the report were confirmed by the victim, and which remain only leak site claims?

Interseguro, Oldelval, Vicksburg, and Albert Einstein have direct communication from the victim or affected entity. By contrast, MCM Telecom, Cotesma, LD Constructora, Brame Telecom, Solutend, TQC S.A., the Association of Notaries of Uruguay, and others appear only as claims or intelligence records. The body of the report separates both layers.

Which incident has the strongest technical evidence, and why?

Colombia’s Ministry of Justice is the strongest case because BlackFog documented file encryption and technological disruption, with impact on public services. Unlike many leak-site-indexed claims, this case includes an operational description of the damage. Even so, the source also makes clear that no public group claimed responsibility.

What makes Interseguro different from the other Peruvian cases in the report?

Interseguro confirmed unauthorized access, limited the scope to its own systems, notified clients, and said policies and operations remained active. The other Peruvian cases, such as TQC S.A., Hermilio Valdizán Hospital, Segres Systec, and the claim against Gob.pe, remain in the realm of intelligence or uncorroborated claims. That difference changes operational priority.

How should the Qilin attribution in Mexico, Chile, and Brazil be read?

It should be read as an intelligence association, not as forensic confirmation. MCM Telecom, Cotesma, LD Constructora, and Brame Telecom appear linked to Qilin in third-party records, but the material does not provide independent evidence of encryption, exfiltration, or operational impact. The report treats those cases as claims, not closed facts.

Which countries show confirmed incidents, and which show a higher density of claims?

Colombia and Peru contain the clearest events, with confirmed ransomware at the Ministry of Justice and confirmed unauthorized access at Interseguro. Mexico, Chile, Uruguay, Brazil, and Bolivia show more leak site claims than fully verified incidents. The United States adds one confirmed case in Vicksburg, plus a high volume of claims in trackers.

Material limitations

The material does not allow verifiable IOCs or a complete technical intrusion line for most cases. It also does not provide hashes, IP addresses, infrastructure domains, samples, malware artifacts, or exfiltration traces. In several incidents, the only available evidence is a leak site publication or an intelligence aggregator record.

Criminal attribution is especially weak in several blocks. MCM Telecom, Cotesma, LD Constructora, Brame Telecom, Solutend, TQC S.A., Anwo S.A., and the Association of Notaries of Uruguay appear in public claims that were not independently corroborated. The report preserves that uncertainty because the material requires it.

There is also no clear group identification in the case of Colombia’s Ministry of Justice. The damage is documented, but not the author. Oldelval is similar, although the reported impact is smaller and the victim did not confirm the specific threat or the vector.

Countries without verifiable coverage in the material are noted in a single final sentence: there are no additional facts for Paraguay beyond the lack of verifiable material, and the remaining mentions are concentrated in the countries covered in the body.

Graphics