Colombia Justice Ministry Confirms Ransomware Attack

Colombia’s Ministry of Justice and Law confirmed on Aug. 3, 2026 that it was hit by a ransomware attack that compromised part of its technology infrastructure and affected the availability of some services.

What did the ministry do after confirming the attack?

The ministry said it immediately activated cybersecurity protocols to contain the incident. In its official statement, acting minister Cielo Rusinque flatly rejected the attack and asked the Attorney General’s Office, the National Police and other competent authorities to move quickly with the investigation, identify those responsible and bring them to justice. She also confirmed the preventive isolation of the compromised systems.

What services are still affected and what channels were enabled?

In a later update, the ministry specified which services were still affected and which continuity measures were activated while recovery work continues. Among the steps taken, it set up alternate in-person service channels at the Chapinero office, the email address gestion.documental@minjusticia.gov.co and the phone line (601) 443 3100 for procedures and guidance.

The agency also said that SGDEA, the Electronic Document and Archive Management System that supports filing and document management, is experiencing temporary disruptions. By contrast, the public query portal, the JustiFácil platform and the LegalApp tool are still operating normally.

According to the official update, the ministry’s technical teams are working nonstop with the Ministry of ICT and other competent authorities to restore affected services securely. The ministry added that it will keep the public informed about recovery progress through its official channels.

In parallel, sources cited by Caracol Radio said the attack was similar to the one that recently affected Ecopetrol, although that comparison was presented as part of claims that have not been officially confirmed. In addition, justice minister designate Iván Cancino publicly denounced what he described as a possible cyberattack on the ministry’s systems and called for quick action to verify who was responsible and what the purpose of the attack was.