Chile: Ransomware hits critical infrastructure

Update October 30, 2026: Entel Digital expanded the details of the cases published in Chile and said Qilin and TheGentlemen would account for seven of the 11 victims recorded in critical infrastructure during 2026. ATLAS also added a tally of 94 Chilean organizations listed on leak sites as of October 29, 2026.

An Entel Digital report cited by G5 Noticias said Chile recorded 11 ransomware victims in critical infrastructure during 2026, and 18 victims across critical infrastructure and essential services between January 2025 and September 2026. The same analysis placed transport and logistics as the most affected sector, with 27.8% of Chilean cases, followed by energy, fuels, water and sanitation at 22.2%. Health and government accounted for 16.7% each.

What did the report show about Chile?

The report attributed to Entel Digital shows that ransomware has already left a visible mark on key Chilean sectors, with cases spread across critical infrastructure and essential services. The figure of 11 victims during 2026, and 18 between January 2025 and September 2026, appears in G5 Noticias coverage as part of a broader analysis of the country.

The sector breakdown also shows where the impact was concentrated. Transport and logistics led with 27.8% of the Chilean victims counted in the analysis, while energy, fuels, water and sanitation accounted for 22.2%. Health and government each made up another 16.7%.

Which groups appear linked to those cases?

Entel Digital said Qilin and TheGentlemen would account for seven of the 11 cases published during 2026 in Chile. The same source says those figures come from claims posted by the groups and do not necessarily confirm operational impact at each organization.

That distinction matters because claims on leak sites do not always equal a verifiable real-world impact. In parallel, the ATLAS register counted 94 Chilean organizations listed as victims on leak sites as of October 29, 2026, although that figure alone also does not prove operational impact or critical infrastructure status.

What is known about TheGentlemen?

TheGentlemen combines data theft and encryption for double extortion, and uses mechanisms intended to disable Defender, destroy backups and evade EDR through drivers, according to Mallory’s technical analysis. Acronis also describes it as a RaaS operation tied to the Qilin ecosystem, and says some Qilin operators set up separate operations, including TheGentlemen.

How does it compare with other recent records?

Data cited by local media show the problem is not limited to a single count or a single source. Pisapapeles reported, based on a Secure Soft report, that 33 Chilean organizations were affected by ransomware between January and August 2026, with cases in mining, telecom, energy, transport, health and technology services, though without a sector-by-sector count.

On top of that, Crónica reported 324 serious incidents notified to Chile’s National Cybersecurity Agency during the first half of 2026. Of those reports, 152 began with a compromised account, and the coverage recalled the notification duties set out in the Cybersecurity Framework Law.

What happened with the Huatacondo solar plant?

Diario Financiero reported, based on the coordinator’s log, that the Huatacondo photovoltaic plant and its BESS may have remained at 0% availability in daily reports from August 28 through at least the October 17 report. That reading suggests a prolonged outage beyond the initial event, but the coverage itself presented it as an unconfirmed attribution.

The case fits into a broader picture of cross-sector resilience. An analysis by the Chilean Association of Information Technology Companies, cited by Poder y Liderazgo, said power outages can also affect telecom infrastructure and mentioned Subtel measures to restore connectivity, including mobile infrastructure with satellite links and up to three days of energy autonomy.

Which sectors appear most exposed?

The materials reviewed point to sectors where an outage can have broad operational effects. In the count cited by G5 Noticias, transport and logistics lead among Chilean victims, followed by energy, fuels, water and sanitation.

Meanwhile, the Secure Soft tally published by Pisapapeles showed cases in mining, telecom, energy, transport, health and technology services. Together, the two reports suggest widespread exposure in sensitive areas, even though the methodologies and scope of the reports are different.