Paraguay Reports 7.4 Million Records Exposed

Update September 9, 2026: coverage of Paraguay now includes an attack attributed to the Brigada Cyber PMC group, with 7.4 million exposed records, plus newer CERT-PY figures on reports and incidents handled since 2023.

Coverage on Paraguay expanded the scope of a ransomware attack to 7.4 million exposed records, while other publications cited CERT-PY in saying the country has more than 9 million data points exposed on the web. The original report on cooperatives and the military bulletin remain part of a broader pattern of pressure on systems and data in the country.

What did local coverage say about the cooperatives?

Caaguazú Noticias Digital reported that a sector leader said Paraguayan cooperatives are coming out of a ransomware attack. In that same passage, the reference was linked to Incoop, the regulator mentioned by the outlet.

The report does not specify victims, technical scope, or whether the impact affected one cooperative or several. It also does not identify the initial vector or describe recovery, but it does point to a sensitive episode for the country’s cooperative and financial ecosystem.

What other exposure figures were mentioned?

The same coverage said Paraguay had seen the largest attack vector in a long time and that, to date, more than 9 million data points are exposed on the web. Those two figures appear as part of the interview published by Caaguazú Noticias Digital, with no further breakdown of origin, record types, or responsible parties.

The report also frames the comment in a conversation about cyberattacks and the use of artificial intelligence. According to that publication, the local sector is seeing signs of sustained pressure on exposed assets, although the text does not separate what belongs to earlier leaks from what belongs to recent incidents.

What was added about the June 2025 attack?

Secondary coverage of the case said data from 7.4 million people was leaked and that the publication happened after the attackers’ timer hit zero on June 13, 2025. Another reading of the incident attributed it to the Brigada Cyber PMC ransomware group.

That same coverage said the group encrypted databases from the Paraguayan government, demanded a multimillion-dollar ransom, and left affected institutions without access to their management systems for days. It also said at least 7.4 million citizen records were exposed.

What changes appear in official and regulatory figures?

More recent publications cite CERT-PY statistics and specify that between January 2023 and July 2026 there were 8,309 reports and 4,109 incidents handled, with about half targeting the private sector. Other reports published on July 17, 2026 repeat that last year saw the largest attack vector in a long time and that, up to that point, more than 9 million data points had been exposed on the web.

A new legal framework was also added. Law No. 7593/2025 on Personal Data Protection requires controllers to notify security incidents to the Control Authority and, where applicable, to the data subject within a period that cannot exceed 72 hours from the moment they became aware of the event.

During the legislative process, the Senate ratified its version of the bill and explicitly introduced that 72-hour deadline. Later analysis adds that the law was enacted on November 27, 2025, sets a two-year vacatio legis, and foresees the creation of the National Personal Data Protection Agency in 2026.

What concrete obligations remain for companies?

Regulatory summaries and local law firms agree that under Law No. 7593/2025, data controllers must notify the authority and affected individuals of any security incident within a maximum of 72 hours. In parallel, a technical analysis of a cybersecurity law approved in 2025 adds a full report within up to 15 business days and the role of a security officer.

That analysis also says the regime applies to telecommunications providers, financial institutions, critical infrastructure operators, and companies that process personal data from Paraguayan citizens, while exempting certain small and medium-sized businesses with fewer than 50 employees that do not handle sensitive data. Another legal and technical study adds the appointment of a data protection officer in certain cases and impact assessments for high-risk processing.

What happened with the Armed Forces?

MercoPress reported, without official confirmation in the available material, that the General Directorate of ICT of Paraguay’s Armed Forces issued a bulletin warning all units about a ransomware infection that allegedly affected its computer systems.

The notice cited by that outlet does not provide technical details or make it possible to know which systems were compromised, whether operations were affected, or whether the incident is still active. Based on the available material, only an internal communication referenced by MercoPress points to a possible intrusion in Paraguay’s military environment.

What is Brigada Cyber PMC’s connection to the ransomware in Paraguay?

Brigada Cyber PMC appears in the most recent coverage as the group attributed to the ransomware attack that exposed 7.4 million records in Paraguay. The report also ties that case to later filings on incidents handled by CERT-PY and to the broader pressure on systems and data in the country.

The body above already notes that other publications attributed the attack to Brigada Cyber PMC and that this reference adds to the figure of 7.4 million exposed records. It also says the episode is part of a string of signals about data exposure and ransomware activity in Paraguay, without adding any new technical details about the group.