Chile adds ransomware victims linked to Qilin

LD Constructora, a Chilean company with offices in Santiago and Coyhaique, appeared in a claim attributed to Qilin and was also listed by the ACSec Ransomware Observatory among publicly disclosed victims tied to that group. Neither mention confirms a breach on its own, and AllDefense Chile said it found no public confirmation from the company, ANCI, or the government CSIRT that would corroborate the claim.

What is known about LD Constructora?

An independent claims registry included LD Constructora among organizations publicly attributed to Qilin, but AllDefense Chile warned that the detection date and the estimated attack date do not prove the start of an intrusion or a technical compromise. The same publication said there was not enough evidence to state initial access, encryption, data publication, or any impact on customers, employees, or suppliers.

ACSec, for its part, clarified that its observatory only reflects public metadata disclosed by the groups themselves, so it does not constitute independent confirmation of either the intrusion or attribution. In that list, LD Constructora appears in the manufacturing sector, among the publicly disclosed victims tied to Qilin.

How does Chile compare regionally?

Chile recorded 55 ransomware victims between January 2025 and September 2026, and 18 of them, equal to 32.7%, were critical infrastructure cases, according to an Entel Digital report cited by Diario Financiero. In the critical infrastructure tally, transportation and logistics accounted for 27.8% of attacks, while energy, fuels, water, and sanitation represented 22.2%.

The same report placed health and government at 16.7% each. The distribution suggests that operational sectors and essential services remain among the most exposed in the country, although the material refers to publicly disclosed victims and does not detail specific intrusion techniques for each case.

What other cases appeared in the coverage?

ADN Radio reported on a data leak affecting the University of Chile Clinical Hospital and linked it to response and governance recommendations for healthcare institutions. The coverage did not independently attribute the leak to Direwolf.

In that context, specialists recommended strengthening detection, institutional response, verification of official channels, and multifactor authentication in light of the risk that leaked information could be misused. The mix of public listings, claim registries, and leak coverage again shows a setting where attribution requires additional confirmation before a specific incident can be treated as proven.